postgresai 0.17.0-dev.5 → 0.17.0-dev.7

package/dist/bin/postgres-ai.js

@@ -13533,7 +13533,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-dev.5",
+  version: "0.17.0-dev.7",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16893,7 +16893,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-dev.5";
+var version = "0.17.0-dev.7";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -21642,7 +21642,7 @@ function summarizeG003(nodeData) {
 
 // lib/checkup.ts
 var __dirname = "/builds/postgres-ai/postgresai/cli/lib";
-var CONTRACT_VERSION = "1.1.0";
+var CONTRACT_VERSION = "1.0.0";
 var SECONDS_PER_DAY = 86400;
 var SECONDS_PER_HOUR = 3600;
 var SECONDS_PER_MINUTE = 60;
@@ -23975,6 +23975,38 @@ function withCheckSummary(report) {
   return report;
 }
 
+// lib/checkup-upload.ts
+function responseId(fn, response, ...keys) {
+  const answer = response ?? {};
+  const id = Number(keys.map((key) => answer[key]).find((value) => value != null));
+  if (!Number.isFinite(id) || id <= 0) {
+    throw new Error(typeof answer.message === "string" ? answer.message : `Unexpected ${fn} response: ${JSON.stringify(response)}`);
+  }
+  return id;
+}
+async function createCheckupReport(rpc, params) {
+  const fn = "checkup_report_create";
+  const response = await rpc(fn, {
+    access_token: params.apiKey,
+    project: params.project,
+    ...params.status ? { status: params.status } : {}
+  });
+  return { reportId: responseId(fn, response, "report_id") };
+}
+async function uploadCheckupReportJson(rpc, params) {
+  const fn = "checkup_report_file_post";
+  const response = await rpc(fn, {
+    access_token: params.apiKey,
+    checkup_report_id: params.reportId,
+    filename: params.filename,
+    check_id: params.checkId,
+    data: params.jsonText,
+    type: "json",
+    generate_issue: true
+  });
+  return { reportChunkId: responseId(fn, response, "report_chunck_id", "report_chunk_id") };
+}
+
 // lib/host-metrics.ts
 import { createHash } from "node:crypto";
 import { chmodSync as chmodSync3, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
@@ -27936,10 +27968,12 @@ function isNumericProjectRef(ref) {
 // lib/connect.ts
 var money = (cents, currency) => currency.toLowerCase() === "usd" ? `$${(cents / 100).toFixed(2)}` : `${(cents / 100).toFixed(2)} ${currency.toUpperCase()}`;
 function priceText(q) {
+  if (!q.billed && q.same_cluster)
+    return `included: same database cluster as ${q.same_cluster}, no extra charge`;
   if (!q.billed)
     return q.free_slots.total ? `free (${q.free_slots.remaining} of ${q.free_slots.total} free slots)` : "free";
   const { amount, currency, interval } = q.price;
-  const base = `${money(amount, currency)}/${interval} per box (${q.plan} plan)${q.subscription ? `, box ${q.quantity + 1} on the subscription` : ""}`;
+  const base = `${money(amount, currency)}/${interval} per database cluster (${q.plan} plan)${q.subscription ? `, cluster ${q.quantity + 1} on the subscription` : ""}`;
   if (q.promo?.valid && q.amount_after_promo !== undefined && q.amount_after_promo !== null) {
     const after = `${money(q.amount_after_promo, currency)}`;
     const how = `with ${q.promo.code} (${q.promo.discount_description})`;
@@ -28007,7 +28041,11 @@ function stateOf(raw) {
 class ClickhouseKeyError extends Error {
 }
 var serverOf = (name) => name.split("/")[0].toLowerCase().replace(/\.(?=$|:)/, "");
-var errorText = (err) => err instanceof Error ? err.message : String(err);
+function clusterOf(url) {
+  const u = parseUrl(url);
+  return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
+}
+var errorText = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText).join("; ") : err instanceof Error ? err.message : String(err);
 var urlPassword = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
 var URL_PARAMS_KEPT = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
@@ -28022,6 +28060,22 @@ function checkUrlParams(url, agent) {
   if (moved.length)
     throw new Error(`The URL's query string sets ${moved.join(" and ")}: put the host and the port in the URL itself (postgresql://user:password@host:5432/dbname), so that the server prepared is the server monitored`);
 }
+function storedPasswordNeeds(monitoringUrl) {
+  const query = new URL(monitoringUrl).search.replace(/^\?/, "");
+  const parts = query ? query.split("&") : [];
+  const keys = parts.map((p) => p.split("=")[0]);
+  const twice = URL_PARAMS_KEPT.filter((k) => keys.indexOf(k) !== keys.lastIndexOf(k));
+  const tls = !twice.includes("sslmode") && parts.some((p) => /^sslmode=(require|verify-ca|verify-full)$/.test(p));
+  const needs = [
+    ...tls ? [] : [`sslmode=require (or verify-full)${twice.includes("sslmode") ? ", once" : ""}`],
+    ...twice.filter((k) => k !== "sslmode").map((k) => `${k} once`),
+    ...parts.some((p) => !p) ? ["no stray &"] : [],
+    ...keys.some((k) => k && !URL_PARAMS_KEPT.includes(k)) ? ["the parameter names without %-escapes"] : []
+  ];
+  return needs.length ? needs.join(" and ") : undefined;
+}
+var shellWord = (s) => /^[\w./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+var disconnectEach = (names) => names.map((n) => `pgai disconnect ${shellWord(n)} --yes`).join(" and ");
 function roleUrlFor(url, db, password, kept) {
   const u = new URL(url);
   u.username = DEFAULT_MONITORING_USER;
@@ -28030,6 +28084,7 @@ function roleUrlFor(url, db, password, kept) {
   for (const name of [...u.searchParams.keys()])
     if (!kept.includes(name))
       u.searchParams.delete(name);
+  u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
 var monitoringUrlFor = (url, db, password) => roleUrlFor(url, db, password, URL_PARAMS_KEPT);
@@ -28082,22 +28137,24 @@ function checkupLines(c) {
   ];
 }
 var boxState = (row) => row.status === "launch_requested" && row.registered_at ? "registered" : row.status ?? "starting";
-async function billingFor(q, name, opts, deps) {
+async function billingFor(q, name, opts, deps, show) {
   const billing = { price: priceText(q), requires_payment_method: q.requires_payment_method };
   if (opts.coupon) {
     billing.coupon = q.promo?.valid ? { code: q.promo.code, valid: true, description: q.promo.discount_description } : { code: opts.coupon, valid: false, error: q.promo?.error ?? "not valid" };
   }
-  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${deps.billingUrl(q.org_alias)}, then re-run` };
-  const stop = (next) => ({ billing, billingPage, accepted: false, stop: { ...billing, next } });
+  const billingUrl = q.billing_url ?? deps.billingUrl(q.org_alias);
+  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${billingUrl}, then re-run` };
+  const stop = (next) => ({ billing, billingPage, billingUrl, accepted: false, stop: { ...billing, next } });
   if (billing.coupon && !billing.coupon.valid) {
     return stop(`Promo code ${opts.coupon}: ${billing.coupon.error}. Nothing was changed: re-run with a valid code, or without ${opts.agent ? "coupon" : "--coupon"}`);
   }
   if (q.requires_payment_method)
-    return { billing, billingPage, accepted: false, stop: billingPage };
-  if (q.billed && !opts.yes && !await deps.confirm(`${name} is billed: ${billing.price}. Provision it? (y/N): `)) {
+    return { billing, billingPage, billingUrl, accepted: false, stop: billingPage };
+  show(billing.price);
+  if (q.billed && !opts.yes && !await deps.confirm(`Provision ${name}? (y/N): `)) {
     return stop(opts.agent ? `Call connect_database again with yes: true to accept ${billing.price}` : `Re-run with --yes to accept ${billing.price}`);
   }
-  return { billing, billingPage, accepted: q.billed };
+  return { billing, billingPage, billingUrl, accepted: q.billed };
 }
 async function connect(url, opts, deps) {
   const started = deps.now();
@@ -28117,7 +28174,7 @@ async function connect(url, opts, deps) {
     return { status: "action_required", provider, name, next: "--reset-password works with PostgresAI Cloud only (it checks what else monitors this server): connect without --self-hosted, or set PGAI_MON_PASSWORD" };
   }
   if (opts.selfHosted && deps.localStackRunning()) {
-    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with pgai mon targets add '<postgres_ai_mon URL>'" };
+    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
   const rows = opts.selfHosted ? [] : await deps.list();
   let row = rows.find((d) => d.name === name && !disconnecting(d.status));
@@ -28127,6 +28184,8 @@ async function connect(url, opts, deps) {
   let billing = {};
   let billingPage;
   let accepted = false;
+  let billingUrl;
+  let undoRole;
   const findOrg = async () => {
     try {
       return await deps.clickhouseOrg(new URL(url).hostname, key.keyId, key.keySecret);
@@ -28160,51 +28219,72 @@ async function connect(url, opts, deps) {
         await deps.unprepare(url).catch(() => false);
     };
     let lockId;
-    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting(d.status) && serverOf(d.name) === serverOf(name));
-    const cutOff = (others) => ({ status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} would cut off the monitoring of ${others.map((d) => d.name).join(", ")} on this server: set PGAI_MON_PASSWORD to its password instead` });
-    if (opts.resetPassword) {
-      if (othersOnServer(rows).length)
-        return cutOff(othersOnServer(rows));
-    }
+    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
+    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting(d.status) && (unread(d) || serverOf(d.name) === serverOf(name)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf(d.name) === serverOf(name)) || undefined;
+    const cutOff = (others) => {
+      const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
+      const maybe = others.filter(unread).map((d) => d.name).join(", ");
+      const what = [on && `would cut off the monitoring of ${on} on this server`, maybe && `may cut off the monitoring of ${maybe} (the platform could not read its URL, so its server is not known)`].filter(Boolean).join(", and ");
+      const instead = [
+        ...storedPassword ? ["connect without --reset-password (PostgresAI keeps its password for this server, and sends it only over TLS)"] : [],
+        "set PGAI_MON_PASSWORD to its password instead",
+        `${disconnectEach(others.map((d) => d.name))} first`
+      ];
+      return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} ${what}: ${instead.join(", or ")}` };
+    };
+    const others = othersOnServer(rows).filter((d) => !unread(d)).map((d) => d.name);
+    if (opts.resetPassword && othersOnServer(rows).length)
+      return cutOff(othersOnServer(rows));
     if (opts.coupon !== undefined && !opts.coupon.trim()) {
       return { status: "action_required", provider, name, next: `${opts.agent ? "coupon" : "--coupon"} is empty: pass a promotion code, or leave ${opts.agent ? "coupon" : "--coupon"} out` };
     }
+    const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
     if (!opts.selfHosted) {
-      const b = await billingFor(await deps.quote(opts.coupon), name, opts, deps);
+      const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
+      if ("next" in probe)
+        return { status: "action_required", provider, name, ...probe };
+      const b = await billingFor(await deps.quote(opts.coupon, clusterOf(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
       if (b.stop)
         return { status: "action_required", provider, name, ...b.stop };
-      ({ billing, billingPage, accepted } = b);
-      progress("billing", `Billing: ${billing.price}`);
+      ({ billing, billingPage, billingUrl, accepted } = b);
     }
     if (opts.resetPassword) {
+      let lock;
       try {
-        lockId = (await deps.resetLock(serverOf(name))).lock_id;
+        lock = await deps.resetLock(serverOf(name));
       } catch (err) {
         if (err instanceof HttpStatusError && err.status === 409) {
-          return { status: "action_required", provider, name, next: `Another pgai connect --reset-password for ${serverOf(name)} is running: wait for it to finish, then re-run` };
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
         }
         if (err instanceof HttpStatusError && err.status === 404) {
-          return { status: "action_required", provider, name, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
+          return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
         }
         throw err;
       }
+      if (typeof lock.lock_id !== "string" || !lock.lock_id)
+        throw new Error("cloud_monitoring_reset_lock returned no lock_id: nothing was changed");
+      lockId = lock.lock_id;
     }
     let prepared;
     let created;
+    let unanswered = false;
     try {
       if (lockId) {
         const now = await deps.list();
         const same = now.find((d) => d.name === name && !disconnecting(d.status));
         if (same)
-          return { status: "action_required", provider, name, id: same.id, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
+          return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
         const others = othersOnServer(now);
         if (others.length)
-          return cutOff(others);
+          return { ...cutOff(others), ...billing };
       }
       progress("preparing", `Preparing ${maskConnectionString(url)}`);
-      prepared = await deps.prepare(url, provider, { resetPassword: opts.resetPassword });
+      prepared = await deps.prepare(url, provider, prepOpts);
       if ("next" in prepared)
         return { status: "action_required", provider, name, ...billing, ...prepared };
+      if (!("monitoringUrl" in prepared))
+        throw new Error("prepare returned no monitoring URL");
       if (prepared.note)
         note = `; ${prepared.note}`;
       if (opts.selfHosted) {
@@ -28221,10 +28301,14 @@ async function connect(url, opts, deps) {
       }).catch(async (err) => {
         if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
           await undo(prepared);
+        else
+          unanswered = true;
         if (err instanceof HttpStatusError && err.status === 402)
           return /declined/i.test(err.message) ? "declined" : "payment";
         if (err instanceof HttpStatusError && err.status === 412)
           return "price";
+        if (err instanceof HttpStatusError && err.status === 409 && "storedPassword" in prepared && prepared.storedPassword && /none is stored/.test(err.message))
+          return "stored";
         throw err;
       });
       if (created === "payment")
@@ -28234,21 +28318,43 @@ async function connect(url, opts, deps) {
       }
       if (created === "price")
         return { status: "action_required", provider, name, ...billing, next: "The price changed since it was shown: re-run pgai connect to see it" };
+      if (created === "stored") {
+        const gone = `PostgresAI no longer keeps the password of ${DEFAULT_MONITORING_USER} for this server`;
+        return { status: "action_required", provider, name, ...billing, next: opts.agent ? `${gone}: pass its URL as database_url, or run pgai connect <admin-url> --reset-password in a terminal` : `${gone}: re-run with --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new one), or set PGAI_MON_PASSWORD to its password` };
+      }
       if (created.status === "failed") {
         await undo(prepared);
         return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
       }
     } finally {
-      if (lockId)
+      if (lockId && !unanswered)
         await deps.resetUnlock(lockId).catch(() => {});
     }
     row = { id: created.id, name: created.name, provider, status: created.status, dashboard_url: null, host_metrics: !!ch };
-    checkup = await deps.checkup(withLocalTls(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText(err) }));
-    progress("checkup", checkupLines(checkup).join(`
+    const made = prepared;
+    undoRole = () => undo(made);
+    if (prepared.storedPassword) {
+      progress("checkup", `Express checkup skipped: it runs only as ${DEFAULT_MONITORING_USER}, whose password PostgresAI keeps for this server. The full checkup follows on the box.`);
+    } else {
+      checkup = await deps.checkup(withLocalTls(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText(err) }));
+      progress("checkup", checkupLines(checkup).join(`
 `), { checkup });
+    }
   }
   let shown;
   for (const deadline = deps.now() + opts.waitMs;; ) {
+    if (undoRole && row.billing_error && disconnecting(row.status)) {
+      await undoRole();
+      return {
+        status: "action_required",
+        provider,
+        name,
+        id: row.id,
+        ...billing,
+        ...checkup ? { checkup } : {},
+        next: `The first charge failed (${row.billing_error}): the box was removed and nothing is billed. Update the payment method at ${billingUrl}, then re-run`
+      };
+    }
     const result = connectStatus(row, provider, fresh);
     const state = boxState(row);
     if (state !== shown && (shown !== undefined || result.status === "provisioning"))
@@ -28262,12 +28368,22 @@ async function connect(url, opts, deps) {
       return { ...rest, ...billing, ...checkup ? { checkup } : {}, next: next + note };
     }
     await deps.sleep(POLL_MS);
-    row = (await deps.list().catch(() => [])).find((d) => d.id === row.id) ?? row;
+    const listed = await deps.list().catch(() => {
+      return;
+    });
+    const now = listed?.find((d) => d.id === row.id);
+    if (listed && !now && undoRole) {
+      await undoRole();
+      return { status: "failed", provider, name, id: row.id, ...billing, next: "The monitoring box was removed before it became active: see pgai databases, then re-run pgai connect" };
+    }
+    row = now ?? row;
   }
 }
-function openConnection(url, opts) {
+async function openConnection(url, opts) {
   const conn = resolveAdminConnection({ conn: url });
-  return connectWithSslFallback(opts.Client ?? Client2, opts.agent ? { ...conn, sslFallbackEnabled: false } : conn);
+  const fallback = !opts.agent && !!conn.sslFallbackEnabled;
+  const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole(client) {
   for (const sql of [`drop role ${DEFAULT_MONITORING_USER}`, `drop owned by ${DEFAULT_MONITORING_USER}; drop role ${DEFAULT_MONITORING_USER}`]) {
@@ -28300,7 +28416,7 @@ async function prepareDatabase(url, provider, opts = {}) {
       throw err;
     }
   };
-  const { client } = await open(url).catch((err) => {
+  const { client, usedSsl, refusedTls } = await open(url).catch((err) => {
     if (/client password must be a string/.test(String(err?.message)))
       throw new Error("The URL has no password (and PGPASSWORD is not set): pgai connect postgresql://user:password@host:5432/dbname");
     throw err;
@@ -28314,7 +28430,7 @@ async function prepareDatabase(url, provider, opts = {}) {
            and has_database_privilege(current_user, current_database(), 'CREATE')
            and exists (select 1 from pg_extension where extname = 'pg_stat_statements')) as admin,
          exists (select 1 from pg_roles where rolname = '${DEFAULT_MONITORING_USER}') as mon_exists,
-         current_setting('scram_iterations', true) as iterations
+         current_setting('scram_iterations', true) as iterations, current_setting('ssl') as ssl
        from pg_roles where rolname = current_user`)).rows[0];
     const notes = [caNote(url)].filter((n) => !!n);
     const noted = () => notes.length ? { note: notes.join("; ") } : {};
@@ -28338,9 +28454,31 @@ async function prepareDatabase(url, provider, opts = {}) {
       }
     } else if (me.admin && pgProvider !== "supabase") {
       const exists = `${DEFAULT_MONITORING_USER} already exists on this server`;
+      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const needs = storedPasswordNeeds(monitoringUrlFor(url, me.db, ""));
+      const noTls = refusedTls || !usedSsl && me.ssl === "off";
+      const tlsOnly = `PostgresAI sends the password it keeps for ${DEFAULT_MONITORING_USER} only over TLS`;
+      const others = opts.others?.length ? opts.others : undefined;
+      const disconnectOthers = others ? disconnectEach(others) : "pgai disconnect the server's other databases (pgai databases)";
+      const reconnectOthers = `(and connect ${others ? others.join(", ") : "them"} again with it)`;
+      const noTlsWayOut = opts.agent ? `Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password. If nobody has it, in a terminal: ${disconnectOthers}, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one ${reconnectOthers}` : `Set PGAI_MON_PASSWORD to its password, or turn on TLS on the server (ssl = on) and put sslmode=require in the URL. If nobody has the password: ${disconnectOthers}, then re-run with --reset-password and PGAI_MON_PASSWORD set to a new one ${reconnectOthers}`;
+      const reuse = me.mon_exists && !opts.resetPassword && !!opts.storedPassword && !(opts.agent ? "" : process.env.PGAI_MON_PASSWORD?.trim());
+      if (reuse && needs) {
+        if (noTls)
+          return { next: `${exists}, but this server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` };
+        return { next: `${exists}. ${opts.agent ? "database_url" : "The URL"} needs ${needs}: the password PostgresAI keeps for this server is sent only over TLS, to a URL with each parameter once` };
+      }
+      if (reuse) {
+        if (opts.check)
+          return { checked: true };
+        const { password: unused } = await resolveMonitoringPassword({ monitoringUser: DEFAULT_MONITORING_USER });
+        const plan = await buildInitPlan({ database: me.db, monitoringPassword: unused, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: true });
+        await applyInitPlan({ client, plan });
+        return { monitoringUrl: monitoringUrlFor(url, me.db, ""), storedPassword: true, ...noted() };
+      }
       if (me.mon_exists && opts.agent)
         return { next: `${exists}. Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password` };
-      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const unset = !opts.storedPassword ? setPassword : noTls ? `This server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` : !needs ? `Unset PGAI_MON_PASSWORD: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server` : `Unset PGAI_MON_PASSWORD, and the URL needs ${needs}: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server, and sends it only over TLS, to a URL with each parameter once`;
       const { password, generated } = await resolveMonitoringPassword({ passwordEnv: opts.agent ? undefined : process.env.PGAI_MON_PASSWORD, monitoringUser: DEFAULT_MONITORING_USER });
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
@@ -28350,13 +28488,16 @@ async function prepareDatabase(url, provider, opts = {}) {
         try {
           accepted = await logsIn(loginUrlFor(url, me.db, password));
         } catch (err) {
-          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from` };
+          const orUnset = opts.storedPassword && !noTls ? ", or unset PGAI_MON_PASSWORD: PostgresAI keeps its password for this server" : "";
+          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from${orUnset}` };
         }
         if (!accepted)
-          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${setPassword}` };
+          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${unset}` };
         if (await acceptsAnyPassword())
           notes.push(unchecked("PGAI_MON_PASSWORD"));
       }
+      if (opts.check)
+        return { checked: true };
       const monitoringUrl = monitoringUrlFor(url, me.db, password);
       const loginUrl = loginUrlFor(url, me.db, password);
       const plan = await buildInitPlan({ database: me.db, monitoringPassword: password, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: !reset });
@@ -28404,26 +28545,17 @@ async function expressCheckup(url, opts = {}) {
   }
 }
 async function saveCheckupReport(rpc, accessToken, project, reports) {
-  const idOf = (fn, answer, ...keys) => {
-    const a = answer ?? {};
-    const id = Number(keys.map((k) => a[k]).find((v) => v !== undefined));
-    if (!(id > 0))
-      throw new Error(typeof a.message === "string" ? a.message : `Unexpected ${fn} answer: ${JSON.stringify(answer)}`);
-    return id;
-  };
-  const reportId = idOf("checkup_report_create", await rpc("checkup_report_create", { access_token: accessToken, project }), "report_id");
+  const { reportId } = await createCheckupReport(rpc, { apiKey: accessToken, project });
   const setStatus = (status) => rpc("checkup_report_status_update", { access_token: accessToken, report_id: reportId, status });
   try {
     for (const [checkId, report] of Object.entries(reports)) {
-      idOf("checkup_report_file_post", await rpc("checkup_report_file_post", {
-        access_token: accessToken,
-        checkup_report_id: reportId,
+      await uploadCheckupReportJson(rpc, {
+        apiKey: accessToken,
+        reportId,
         filename: `${checkId}.json`,
-        check_id: checkId,
-        data: JSON.stringify(report, null, 2),
-        type: "json",
-        generate_issue: true
-      }), "report_chunck_id", "report_chunk_id");
+        checkId,
+        jsonText: JSON.stringify(report, null, 2)
+      });
     }
   } catch (err) {
     await setStatus("failed").catch(() => {});
@@ -28473,7 +28605,7 @@ function platformDeps(p) {
     unprepare: (url) => unprepareDatabase(url, { agent: p.agent }),
     clickhouseOrg: clickhouseOrgFor,
     checkup: (url, project) => expressCheckup(url, { agent: p.agent, save: (reports) => saveCheckupReport(rpc, p.apiKey, project, reports) }),
-    quote: (coupon) => rpc("cloud_monitoring_quote", coupon ? { promo_code: coupon } : {}),
+    quote: (coupon, cluster) => rpc("cloud_monitoring_quote", { ...coupon ? { promo_code: coupon } : {}, ...cluster ? { db_server: cluster } : {} }),
     billingUrl: (orgAlias) => `${p.uiBaseUrl}/${orgAlias}/billing`,
     handoffUrl: async (provider) => {
       const orgs = await listOrgs({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl });
@@ -35744,7 +35876,7 @@ async function startMcpServer(rootOpts, extra) {
         },
         {
           name: "connect_database",
-          description: "Put a Postgres database under PostgresAI Cloud monitoring (same as `pgai connect`): prepares the monitoring role (an admin URL creates it; otherwise returns the SQL), provisions the monitoring box, and returns JSON with status (connected | provisioning | disconnecting | action_required | failed), dashboard_url and next (the exact next action). A billed box is provisioned only with yes: true: without it the result is action_required with the price (and requires_payment_method), so show the price to the user first. It does not wait for the box: call it again to see the status. Safe to call again. ClickHouse Managed Postgres, RDS and Supabase are detected from the host. The URL must carry its password, and only these query parameters: sslmode, channel_binding, application_name. PGAI_MON_PASSWORD, PGPASSWORD and CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET of the server process are not used (pass clickhouse_key), and a TLS failure is not retried in plaintext (say sslmode=disable for a server without TLS).",
+          description: "Put a Postgres database under PostgresAI Cloud monitoring (same as `pgai connect`): prepares the monitoring role (an admin URL creates it; otherwise returns the SQL), provisions the monitoring box, and returns JSON with status (connected | provisioning | disconnecting | action_required | failed), dashboard_url and next (the exact next action). A billed box is provisioned only with yes: true: without it the result is action_required with the price (and requires_payment_method), so show the price to the user first. It does not wait for the box: call it again to see the status. Safe to call again. ClickHouse Managed Postgres, RDS and Supabase are detected from the host. The URL must carry its password, and only these query parameters: sslmode, channel_binding, application_name. PGAI_MON_PASSWORD, PGPASSWORD and CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET of the server process are not used (pass clickhouse_key), and a TLS failure is not retried in plaintext (say sslmode=disable for a server without TLS). For another database on a server PostgresAI already monitors for the org, an admin URL with sslmode=require (or verify-*), each query parameter once, is enough: PostgresAI fills in the password of postgres_ai_mon it keeps, over TLS only (on a server without TLS, pass the postgres_ai_mon URL; if nobody has its password, the user runs in a terminal: pgai disconnect the server's other databases, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one, then connects them again with it).",
           inputSchema: {
             type: "object",
             properties: {
@@ -36658,10 +36790,12 @@ function renderMarkdownForTerminal(md) {
 // lib/connect.ts
 var money2 = (cents, currency) => currency.toLowerCase() === "usd" ? `$${(cents / 100).toFixed(2)}` : `${(cents / 100).toFixed(2)} ${currency.toUpperCase()}`;
 function priceText2(q) {
+  if (!q.billed && q.same_cluster)
+    return `included: same database cluster as ${q.same_cluster}, no extra charge`;
   if (!q.billed)
     return q.free_slots.total ? `free (${q.free_slots.remaining} of ${q.free_slots.total} free slots)` : "free";
   const { amount, currency, interval } = q.price;
-  const base = `${money2(amount, currency)}/${interval} per box (${q.plan} plan)${q.subscription ? `, box ${q.quantity + 1} on the subscription` : ""}`;
+  const base = `${money2(amount, currency)}/${interval} per database cluster (${q.plan} plan)${q.subscription ? `, cluster ${q.quantity + 1} on the subscription` : ""}`;
   if (q.promo?.valid && q.amount_after_promo !== undefined && q.amount_after_promo !== null) {
     const after = `${money2(q.amount_after_promo, currency)}`;
     const how = `with ${q.promo.code} (${q.promo.discount_description})`;
@@ -36729,7 +36863,11 @@ function stateOf2(raw) {
 class ClickhouseKeyError2 extends Error {
 }
 var serverOf2 = (name) => name.split("/")[0].toLowerCase().replace(/\.(?=$|:)/, "");
-var errorText2 = (err) => err instanceof Error ? err.message : String(err);
+function clusterOf2(url) {
+  const u = parseUrl2(url);
+  return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
+}
+var errorText2 = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText2).join("; ") : err instanceof Error ? err.message : String(err);
 var urlPassword2 = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
 var URL_PARAMS_KEPT2 = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS2 = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
@@ -36744,6 +36882,22 @@ function checkUrlParams2(url, agent) {
   if (moved.length)
     throw new Error(`The URL's query string sets ${moved.join(" and ")}: put the host and the port in the URL itself (postgresql://user:password@host:5432/dbname), so that the server prepared is the server monitored`);
 }
+function storedPasswordNeeds2(monitoringUrl) {
+  const query = new URL(monitoringUrl).search.replace(/^\?/, "");
+  const parts = query ? query.split("&") : [];
+  const keys = parts.map((p) => p.split("=")[0]);
+  const twice = URL_PARAMS_KEPT2.filter((k) => keys.indexOf(k) !== keys.lastIndexOf(k));
+  const tls = !twice.includes("sslmode") && parts.some((p) => /^sslmode=(require|verify-ca|verify-full)$/.test(p));
+  const needs = [
+    ...tls ? [] : [`sslmode=require (or verify-full)${twice.includes("sslmode") ? ", once" : ""}`],
+    ...twice.filter((k) => k !== "sslmode").map((k) => `${k} once`),
+    ...parts.some((p) => !p) ? ["no stray &"] : [],
+    ...keys.some((k) => k && !URL_PARAMS_KEPT2.includes(k)) ? ["the parameter names without %-escapes"] : []
+  ];
+  return needs.length ? needs.join(" and ") : undefined;
+}
+var shellWord2 = (s) => /^[\w./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+var disconnectEach2 = (names) => names.map((n) => `pgai disconnect ${shellWord2(n)} --yes`).join(" and ");
 function roleUrlFor2(url, db, password, kept) {
   const u = new URL(url);
   u.username = DEFAULT_MONITORING_USER;
@@ -36752,6 +36906,7 @@ function roleUrlFor2(url, db, password, kept) {
   for (const name of [...u.searchParams.keys()])
     if (!kept.includes(name))
       u.searchParams.delete(name);
+  u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
 var monitoringUrlFor2 = (url, db, password) => roleUrlFor2(url, db, password, URL_PARAMS_KEPT2);
@@ -36813,22 +36968,24 @@ function progressText(e) {
 `);
 }
 var boxState2 = (row) => row.status === "launch_requested" && row.registered_at ? "registered" : row.status ?? "starting";
-async function billingFor2(q, name, opts, deps) {
+async function billingFor2(q, name, opts, deps, show) {
   const billing = { price: priceText2(q), requires_payment_method: q.requires_payment_method };
   if (opts.coupon) {
     billing.coupon = q.promo?.valid ? { code: q.promo.code, valid: true, description: q.promo.discount_description } : { code: opts.coupon, valid: false, error: q.promo?.error ?? "not valid" };
   }
-  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${deps.billingUrl(q.org_alias)}, then re-run` };
-  const stop = (next) => ({ billing, billingPage, accepted: false, stop: { ...billing, next } });
+  const billingUrl = q.billing_url ?? deps.billingUrl(q.org_alias);
+  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${billingUrl}, then re-run` };
+  const stop = (next) => ({ billing, billingPage, billingUrl, accepted: false, stop: { ...billing, next } });
   if (billing.coupon && !billing.coupon.valid) {
     return stop(`Promo code ${opts.coupon}: ${billing.coupon.error}. Nothing was changed: re-run with a valid code, or without ${opts.agent ? "coupon" : "--coupon"}`);
   }
   if (q.requires_payment_method)
-    return { billing, billingPage, accepted: false, stop: billingPage };
-  if (q.billed && !opts.yes && !await deps.confirm(`${name} is billed: ${billing.price}. Provision it? (y/N): `)) {
+    return { billing, billingPage, billingUrl, accepted: false, stop: billingPage };
+  show(billing.price);
+  if (q.billed && !opts.yes && !await deps.confirm(`Provision ${name}? (y/N): `)) {
     return stop(opts.agent ? `Call connect_database again with yes: true to accept ${billing.price}` : `Re-run with --yes to accept ${billing.price}`);
   }
-  return { billing, billingPage, accepted: q.billed };
+  return { billing, billingPage, billingUrl, accepted: q.billed };
 }
 async function connect2(url, opts, deps) {
   const started = deps.now();
@@ -36848,7 +37005,7 @@ async function connect2(url, opts, deps) {
     return { status: "action_required", provider, name, next: "--reset-password works with PostgresAI Cloud only (it checks what else monitors this server): connect without --self-hosted, or set PGAI_MON_PASSWORD" };
   }
   if (opts.selfHosted && deps.localStackRunning()) {
-    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with pgai mon targets add '<postgres_ai_mon URL>'" };
+    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
   const rows = opts.selfHosted ? [] : await deps.list();
   let row = rows.find((d) => d.name === name && !disconnecting2(d.status));
@@ -36858,6 +37015,8 @@ async function connect2(url, opts, deps) {
   let billing = {};
   let billingPage;
   let accepted = false;
+  let billingUrl;
+  let undoRole;
   const findOrg = async () => {
     try {
       return await deps.clickhouseOrg(new URL(url).hostname, key.keyId, key.keySecret);
@@ -36891,51 +37050,72 @@ async function connect2(url, opts, deps) {
         await deps.unprepare(url).catch(() => false);
     };
     let lockId;
-    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting2(d.status) && serverOf2(d.name) === serverOf2(name));
-    const cutOff = (others) => ({ status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} would cut off the monitoring of ${others.map((d) => d.name).join(", ")} on this server: set PGAI_MON_PASSWORD to its password instead` });
-    if (opts.resetPassword) {
-      if (othersOnServer(rows).length)
-        return cutOff(othersOnServer(rows));
-    }
+    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
+    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting2(d.status) && (unread(d) || serverOf2(d.name) === serverOf2(name)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf2(d.name) === serverOf2(name)) || undefined;
+    const cutOff = (others) => {
+      const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
+      const maybe = others.filter(unread).map((d) => d.name).join(", ");
+      const what = [on && `would cut off the monitoring of ${on} on this server`, maybe && `may cut off the monitoring of ${maybe} (the platform could not read its URL, so its server is not known)`].filter(Boolean).join(", and ");
+      const instead = [
+        ...storedPassword ? ["connect without --reset-password (PostgresAI keeps its password for this server, and sends it only over TLS)"] : [],
+        "set PGAI_MON_PASSWORD to its password instead",
+        `${disconnectEach2(others.map((d) => d.name))} first`
+      ];
+      return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} ${what}: ${instead.join(", or ")}` };
+    };
+    const others = othersOnServer(rows).filter((d) => !unread(d)).map((d) => d.name);
+    if (opts.resetPassword && othersOnServer(rows).length)
+      return cutOff(othersOnServer(rows));
     if (opts.coupon !== undefined && !opts.coupon.trim()) {
       return { status: "action_required", provider, name, next: `${opts.agent ? "coupon" : "--coupon"} is empty: pass a promotion code, or leave ${opts.agent ? "coupon" : "--coupon"} out` };
     }
+    const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
     if (!opts.selfHosted) {
-      const b = await billingFor2(await deps.quote(opts.coupon), name, opts, deps);
+      const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
+      if ("next" in probe)
+        return { status: "action_required", provider, name, ...probe };
+      const b = await billingFor2(await deps.quote(opts.coupon, clusterOf2(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
       if (b.stop)
         return { status: "action_required", provider, name, ...b.stop };
-      ({ billing, billingPage, accepted } = b);
-      progress("billing", `Billing: ${billing.price}`);
+      ({ billing, billingPage, billingUrl, accepted } = b);
     }
     if (opts.resetPassword) {
+      let lock;
       try {
-        lockId = (await deps.resetLock(serverOf2(name))).lock_id;
+        lock = await deps.resetLock(serverOf2(name));
       } catch (err) {
         if (err instanceof HttpStatusError && err.status === 409) {
-          return { status: "action_required", provider, name, next: `Another pgai connect --reset-password for ${serverOf2(name)} is running: wait for it to finish, then re-run` };
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf2(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
         }
         if (err instanceof HttpStatusError && err.status === 404) {
-          return { status: "action_required", provider, name, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
+          return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
         }
         throw err;
       }
+      if (typeof lock.lock_id !== "string" || !lock.lock_id)
+        throw new Error("cloud_monitoring_reset_lock returned no lock_id: nothing was changed");
+      lockId = lock.lock_id;
     }
     let prepared;
     let created;
+    let unanswered = false;
     try {
       if (lockId) {
         const now = await deps.list();
         const same = now.find((d) => d.name === name && !disconnecting2(d.status));
         if (same)
-          return { status: "action_required", provider, name, id: same.id, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
+          return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
         const others = othersOnServer(now);
         if (others.length)
-          return cutOff(others);
+          return { ...cutOff(others), ...billing };
       }
       progress("preparing", `Preparing ${maskConnectionString(url)}`);
-      prepared = await deps.prepare(url, provider, { resetPassword: opts.resetPassword });
+      prepared = await deps.prepare(url, provider, prepOpts);
       if ("next" in prepared)
         return { status: "action_required", provider, name, ...billing, ...prepared };
+      if (!("monitoringUrl" in prepared))
+        throw new Error("prepare returned no monitoring URL");
       if (prepared.note)
         note = `; ${prepared.note}`;
       if (opts.selfHosted) {
@@ -36952,10 +37132,14 @@ async function connect2(url, opts, deps) {
       }).catch(async (err) => {
         if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
           await undo(prepared);
+        else
+          unanswered = true;
         if (err instanceof HttpStatusError && err.status === 402)
           return /declined/i.test(err.message) ? "declined" : "payment";
         if (err instanceof HttpStatusError && err.status === 412)
           return "price";
+        if (err instanceof HttpStatusError && err.status === 409 && "storedPassword" in prepared && prepared.storedPassword && /none is stored/.test(err.message))
+          return "stored";
         throw err;
       });
       if (created === "payment")
@@ -36965,21 +37149,43 @@ async function connect2(url, opts, deps) {
       }
       if (created === "price")
         return { status: "action_required", provider, name, ...billing, next: "The price changed since it was shown: re-run pgai connect to see it" };
+      if (created === "stored") {
+        const gone = `PostgresAI no longer keeps the password of ${DEFAULT_MONITORING_USER} for this server`;
+        return { status: "action_required", provider, name, ...billing, next: opts.agent ? `${gone}: pass its URL as database_url, or run pgai connect <admin-url> --reset-password in a terminal` : `${gone}: re-run with --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new one), or set PGAI_MON_PASSWORD to its password` };
+      }
       if (created.status === "failed") {
         await undo(prepared);
         return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
       }
     } finally {
-      if (lockId)
+      if (lockId && !unanswered)
         await deps.resetUnlock(lockId).catch(() => {});
     }
     row = { id: created.id, name: created.name, provider, status: created.status, dashboard_url: null, host_metrics: !!ch };
-    checkup = await deps.checkup(withLocalTls2(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText2(err) }));
-    progress("checkup", checkupLines2(checkup).join(`
+    const made = prepared;
+    undoRole = () => undo(made);
+    if (prepared.storedPassword) {
+      progress("checkup", `Express checkup skipped: it runs only as ${DEFAULT_MONITORING_USER}, whose password PostgresAI keeps for this server. The full checkup follows on the box.`);
+    } else {
+      checkup = await deps.checkup(withLocalTls2(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText2(err) }));
+      progress("checkup", checkupLines2(checkup).join(`
 `), { checkup });
+    }
   }
   let shown;
   for (const deadline = deps.now() + opts.waitMs;; ) {
+    if (undoRole && row.billing_error && disconnecting2(row.status)) {
+      await undoRole();
+      return {
+        status: "action_required",
+        provider,
+        name,
+        id: row.id,
+        ...billing,
+        ...checkup ? { checkup } : {},
+        next: `The first charge failed (${row.billing_error}): the box was removed and nothing is billed. Update the payment method at ${billingUrl}, then re-run`
+      };
+    }
     const result = connectStatus2(row, provider, fresh);
     const state = boxState2(row);
     if (state !== shown && (shown !== undefined || result.status === "provisioning"))
@@ -36993,12 +37199,22 @@ async function connect2(url, opts, deps) {
       return { ...rest, ...billing, ...checkup ? { checkup } : {}, next: next + note };
     }
     await deps.sleep(POLL_MS2);
-    row = (await deps.list().catch(() => [])).find((d) => d.id === row.id) ?? row;
+    const listed = await deps.list().catch(() => {
+      return;
+    });
+    const now = listed?.find((d) => d.id === row.id);
+    if (listed && !now && undoRole) {
+      await undoRole();
+      return { status: "failed", provider, name, id: row.id, ...billing, next: "The monitoring box was removed before it became active: see pgai databases, then re-run pgai connect" };
+    }
+    row = now ?? row;
   }
 }
-function openConnection2(url, opts) {
+async function openConnection2(url, opts) {
   const conn = resolveAdminConnection({ conn: url });
-  return connectWithSslFallback(opts.Client ?? Client2, opts.agent ? { ...conn, sslFallbackEnabled: false } : conn);
+  const fallback = !opts.agent && !!conn.sslFallbackEnabled;
+  const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole2(client) {
   for (const sql of [`drop role ${DEFAULT_MONITORING_USER}`, `drop owned by ${DEFAULT_MONITORING_USER}; drop role ${DEFAULT_MONITORING_USER}`]) {
@@ -37031,7 +37247,7 @@ async function prepareDatabase2(url, provider, opts = {}) {
       throw err;
     }
   };
-  const { client } = await open(url).catch((err) => {
+  const { client, usedSsl, refusedTls } = await open(url).catch((err) => {
     if (/client password must be a string/.test(String(err?.message)))
       throw new Error("The URL has no password (and PGPASSWORD is not set): pgai connect postgresql://user:password@host:5432/dbname");
     throw err;
@@ -37045,7 +37261,7 @@ async function prepareDatabase2(url, provider, opts = {}) {
            and has_database_privilege(current_user, current_database(), 'CREATE')
            and exists (select 1 from pg_extension where extname = 'pg_stat_statements')) as admin,
          exists (select 1 from pg_roles where rolname = '${DEFAULT_MONITORING_USER}') as mon_exists,
-         current_setting('scram_iterations', true) as iterations
+         current_setting('scram_iterations', true) as iterations, current_setting('ssl') as ssl
        from pg_roles where rolname = current_user`)).rows[0];
     const notes = [caNote2(url)].filter((n) => !!n);
     const noted = () => notes.length ? { note: notes.join("; ") } : {};
@@ -37069,9 +37285,31 @@ async function prepareDatabase2(url, provider, opts = {}) {
       }
     } else if (me.admin && pgProvider !== "supabase") {
       const exists = `${DEFAULT_MONITORING_USER} already exists on this server`;
+      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const needs = storedPasswordNeeds2(monitoringUrlFor2(url, me.db, ""));
+      const noTls = refusedTls || !usedSsl && me.ssl === "off";
+      const tlsOnly = `PostgresAI sends the password it keeps for ${DEFAULT_MONITORING_USER} only over TLS`;
+      const others = opts.others?.length ? opts.others : undefined;
+      const disconnectOthers = others ? disconnectEach2(others) : "pgai disconnect the server's other databases (pgai databases)";
+      const reconnectOthers = `(and connect ${others ? others.join(", ") : "them"} again with it)`;
+      const noTlsWayOut = opts.agent ? `Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password. If nobody has it, in a terminal: ${disconnectOthers}, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one ${reconnectOthers}` : `Set PGAI_MON_PASSWORD to its password, or turn on TLS on the server (ssl = on) and put sslmode=require in the URL. If nobody has the password: ${disconnectOthers}, then re-run with --reset-password and PGAI_MON_PASSWORD set to a new one ${reconnectOthers}`;
+      const reuse = me.mon_exists && !opts.resetPassword && !!opts.storedPassword && !(opts.agent ? "" : process.env.PGAI_MON_PASSWORD?.trim());
+      if (reuse && needs) {
+        if (noTls)
+          return { next: `${exists}, but this server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` };
+        return { next: `${exists}. ${opts.agent ? "database_url" : "The URL"} needs ${needs}: the password PostgresAI keeps for this server is sent only over TLS, to a URL with each parameter once` };
+      }
+      if (reuse) {
+        if (opts.check)
+          return { checked: true };
+        const { password: unused } = await resolveMonitoringPassword({ monitoringUser: DEFAULT_MONITORING_USER });
+        const plan = await buildInitPlan({ database: me.db, monitoringPassword: unused, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: true });
+        await applyInitPlan({ client, plan });
+        return { monitoringUrl: monitoringUrlFor2(url, me.db, ""), storedPassword: true, ...noted() };
+      }
       if (me.mon_exists && opts.agent)
         return { next: `${exists}. Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password` };
-      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const unset = !opts.storedPassword ? setPassword : noTls ? `This server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` : !needs ? `Unset PGAI_MON_PASSWORD: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server` : `Unset PGAI_MON_PASSWORD, and the URL needs ${needs}: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server, and sends it only over TLS, to a URL with each parameter once`;
       const { password, generated } = await resolveMonitoringPassword({ passwordEnv: opts.agent ? undefined : process.env.PGAI_MON_PASSWORD, monitoringUser: DEFAULT_MONITORING_USER });
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
@@ -37081,13 +37319,16 @@ async function prepareDatabase2(url, provider, opts = {}) {
         try {
           accepted = await logsIn(loginUrlFor2(url, me.db, password));
         } catch (err) {
-          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from` };
+          const orUnset = opts.storedPassword && !noTls ? ", or unset PGAI_MON_PASSWORD: PostgresAI keeps its password for this server" : "";
+          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from${orUnset}` };
         }
         if (!accepted)
-          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${setPassword}` };
+          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${unset}` };
         if (await acceptsAnyPassword())
           notes.push(unchecked("PGAI_MON_PASSWORD"));
       }
+      if (opts.check)
+        return { checked: true };
       const monitoringUrl = monitoringUrlFor2(url, me.db, password);
       const loginUrl = loginUrlFor2(url, me.db, password);
       const plan = await buildInitPlan({ database: me.db, monitoringPassword: password, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: !reset });
@@ -37135,26 +37376,17 @@ async function expressCheckup2(url, opts = {}) {
   }
 }
 async function saveCheckupReport2(rpc, accessToken, project, reports) {
-  const idOf = (fn, answer, ...keys) => {
-    const a = answer ?? {};
-    const id = Number(keys.map((k) => a[k]).find((v) => v !== undefined));
-    if (!(id > 0))
-      throw new Error(typeof a.message === "string" ? a.message : `Unexpected ${fn} answer: ${JSON.stringify(answer)}`);
-    return id;
-  };
-  const reportId = idOf("checkup_report_create", await rpc("checkup_report_create", { access_token: accessToken, project }), "report_id");
+  const { reportId } = await createCheckupReport(rpc, { apiKey: accessToken, project });
   const setStatus = (status) => rpc("checkup_report_status_update", { access_token: accessToken, report_id: reportId, status });
   try {
     for (const [checkId, report] of Object.entries(reports)) {
-      idOf("checkup_report_file_post", await rpc("checkup_report_file_post", {
-        access_token: accessToken,
-        checkup_report_id: reportId,
+      await uploadCheckupReportJson(rpc, {
+        apiKey: accessToken,
+        reportId,
         filename: `${checkId}.json`,
-        check_id: checkId,
-        data: JSON.stringify(report, null, 2),
-        type: "json",
-        generate_issue: true
-      }), "report_chunck_id", "report_chunk_id");
+        checkId,
+        jsonText: JSON.stringify(report, null, 2)
+      });
     }
   } catch (err) {
     await setStatus("failed").catch(() => {});
@@ -37192,6 +37424,22 @@ async function clickhouseOrgFor2(host, keyId, keySecret) {
   }
   throw failed ?? notFound;
 }
+function disconnectBilling(reply) {
+  const r = reply ?? {};
+  if (r.billing?.subscription === "canceled" && r.billing.credited && r.billing_warning)
+    return `subscription canceled: no further charges; the refund failed (${r.billing_warning})`;
+  if (r.billing_warning)
+    return `not released (${r.billing_warning}): contact support`;
+  if (r.billing?.subscription === "canceled" && typeof r.billing.refunded === "number" && r.billing.refunded > 0) {
+    return `subscription canceled: no further charges; refunded ${money2(r.billing.refunded, r.billing.currency ?? "usd")} to your card`;
+  }
+  if (r.billing?.subscription === "canceled")
+    return "subscription canceled: no further charges; the unused part of this period is credited (prorated)";
+  if (r.billing?.subscription === "active" && typeof r.billing.quantity === "number") {
+    return `${r.billing.quantity} ${r.billing.quantity === 1 ? "database cluster" : "database clusters"} left on the subscription`;
+  }
+  return;
+}
 function platformDeps2(p) {
   const rpc = (fn, body = {}) => callRpc({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl, fn, body, operation: fn.replace(/_/g, " "), debug: p.debug, orgScope: p.orgScope });
   return {
@@ -37204,7 +37452,7 @@ function platformDeps2(p) {
     unprepare: (url) => unprepareDatabase2(url, { agent: p.agent }),
     clickhouseOrg: clickhouseOrgFor2,
     checkup: (url, project) => expressCheckup2(url, { agent: p.agent, save: (reports) => saveCheckupReport2(rpc, p.apiKey, project, reports) }),
-    quote: (coupon) => rpc("cloud_monitoring_quote", coupon ? { promo_code: coupon } : {}),
+    quote: (coupon, cluster) => rpc("cloud_monitoring_quote", { ...coupon ? { promo_code: coupon } : {}, ...cluster ? { db_server: cluster } : {} }),
     billingUrl: (orgAlias) => `${p.uiBaseUrl}/${orgAlias}/billing`,
     handoffUrl: async (provider) => {
       const orgs = await listOrgs({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl });
@@ -39329,10 +39577,6 @@ async function applyUninitPlan(params) {
   }
   return { applied, errors };
 }
-async function legacyHelperWarnings(client) {
-  const r = await client.query("select to_regprocedure('postgres_ai.explain_generic(text,text,text)') is not null as present");
-  return r.rows?.[0]?.present ? ["legacy SECURITY DEFINER helper postgres_ai.explain_generic(text, text, text) is still installed; its owner or a superuser must drop it"] : [];
-}
 async function verifyInitSetup2(params) {
   await params.client.query("begin isolation level repeatable read;");
   try {
@@ -40497,7 +40741,7 @@ function feedbackMessage() {
 }
 
 // bin/postgres-ai.ts
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 import { Writable } from "stream";
 import * as childProcess from "child_process";
 
@@ -40505,7 +40749,7 @@ import * as childProcess from "child_process";
 import * as fs9 from "fs";
 import * as path8 from "path";
 var __dirname = "/builds/postgres-ai/postgresai/cli/lib";
-var CONTRACT_VERSION2 = "1.1.0";
+var CONTRACT_VERSION2 = "1.0.0";
 var SECONDS_PER_DAY2 = 86400;
 var SECONDS_PER_HOUR2 = 3600;
 var SECONDS_PER_MINUTE2 = 60;
@@ -43090,48 +43334,11 @@ async function verifyApiKey(params) {
     clearTimeout(timer);
   }
 }
-async function createCheckupReport(params) {
-  const { apiKey, apiBaseUrl, project, status } = params;
-  const bodyObj = {
-    access_token: apiKey,
-    project
-  };
-  if (status)
-    bodyObj.status = status;
-  const resp = await postRpc({
-    apiKey,
-    apiBaseUrl,
-    rpcName: "checkup_report_create",
-    bodyObj
-  });
-  const reportId = Number(resp?.report_id);
-  if (!Number.isFinite(reportId) || reportId <= 0) {
-    throw new Error(`Unexpected checkup_report_create response: ${JSON.stringify(resp)}`);
-  }
-  return { reportId };
+async function createCheckupReport2(params) {
+  return createCheckupReport((rpcName, bodyObj) => postRpc({ ...params, rpcName, bodyObj }), params);
 }
-async function uploadCheckupReportJson(params) {
-  const { apiKey, apiBaseUrl, reportId, filename, checkId, jsonText } = params;
-  const bodyObj = {
-    access_token: apiKey,
-    checkup_report_id: reportId,
-    filename,
-    check_id: checkId,
-    data: jsonText,
-    type: "json",
-    generate_issue: true
-  };
-  const resp = await postRpc({
-    apiKey,
-    apiBaseUrl,
-    rpcName: "checkup_report_file_post",
-    bodyObj
-  });
-  const chunkId = Number(resp?.report_chunck_id ?? resp?.report_chunk_id);
-  if (!Number.isFinite(chunkId) || chunkId <= 0) {
-    throw new Error(`Unexpected checkup_report_file_post response: ${JSON.stringify(resp)}`);
-  }
-  return { reportChunkId: chunkId };
+async function uploadCheckupReportJson2(params) {
+  return uploadCheckupReportJson((rpcName, bodyObj) => postRpc({ ...params, rpcName, bodyObj }), params);
 }
 async function convertCheckupReportJsonToMarkdown(params) {
   const { apiKey, apiBaseUrl, checkId, jsonPayload, reportType } = params;
@@ -43525,21 +43732,45 @@ function summarizeG0032(nodeData) {
 }
 
 // lib/json-stderr.ts
+import { spawn, spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
 import { format } from "node:util";
 function writeEvent(event) {
   process.stderr.write(`${JSON.stringify(event)}
 `);
 }
-async function withJsonStderr(fn) {
+function jsonConsole() {
   const { error, warn } = console;
-  console.error = (...args) => writeEvent({ event: "log", level: "error", message: format(...args) });
-  console.warn = (...args) => writeEvent({ event: "log", level: "warn", message: format(...args) });
-  try {
-    return await fn();
-  } finally {
+  const log = (level) => (...args) => {
+    const message = format(...args);
+    writeEvent({ event: "log", level: /^\s*Debug:/.test(message) ? "debug" : /^\s*(?:\[[^\]]+\]\s*)?Warning:/.test(message) ? "warn" : level, message });
+  };
+  console.error = log("error");
+  console.warn = log("warn");
+  return () => {
     console.error = error;
     console.warn = warn;
-  }
+  };
+}
+var LOGIN = /^(\s*(?:Login|VictoriaMetrics Auth): ).+$/;
+function runChild(command, args, env, json, source) {
+  if (!json)
+    return Promise.resolve(spawnSync(command, args, { stdio: ["ignore", 2, 2], env }).status);
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"], env });
+    for (const [stream, level] of [[child.stdout, "info"], [child.stderr, "error"]]) {
+      createInterface({ input: stream }).on("line", (line) => {
+        const message = line.replace(LOGIN, "$1***** (pgai mon show-grafana-credentials)");
+        if (line.trim() !== "")
+          writeEvent({ event: "log", level, source, message });
+      });
+    }
+    child.on("error", (err) => {
+      writeEvent({ event: "log", level: "error", source, message: err.message });
+      resolve(null);
+    });
+    child.on("close", (code) => resolve(code));
+  });
 }
 
 // lib/instances.ts
@@ -43687,12 +43918,22 @@ function buildClientConfig(connStr, extra = {}) {
     port: parsed.port ? Number(parsed.port) : undefined,
     user: parsed.user,
     password: parsed.password,
-    database: parsed.database || undefined,
+    database: databaseName3(withoutSslmode(channelBinding.uri), parsed.database),
     ssl: sslOptionFromSslmode(sslmode),
     ...enableChannelBinding ? { enableChannelBinding: true } : {},
     ...extra
   };
 }
+function databaseName3(connStr, parsed) {
+  if (!parsed)
+    return;
+  try {
+    const u = new URL(connStr);
+    if (/^postgres(ql)?:$/.test(u.protocol))
+      return decodeURIComponent(u.pathname.slice(1));
+  } catch {}
+  return parsed;
+}
 function withoutSslmode(connStr) {
   try {
     const u = new URL(connStr);
@@ -43736,7 +43977,7 @@ Download: https://nodejs.org/`);
 var rl = null;
 function getReadline() {
   if (!rl) {
-    rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl = createInterface2({ input: process.stdin, output: process.stdout });
   }
   return rl;
 }
@@ -43961,7 +44202,7 @@ async function execFilePromise(file, args, options = {}) {
     });
   });
 }
-function spawnSync2(cmd, args, options) {
+function spawnSync3(cmd, args, options) {
   const result = childProcess.spawnSync(cmd, args, {
     stdio: options?.stdio === "inherit" ? "inherit" : "pipe",
     env: options?.env,
@@ -43974,7 +44215,7 @@ function spawnSync2(cmd, args, options) {
     stderr: typeof result.stderr === "string" ? result.stderr : ""
   };
 }
-function spawn2(cmd, args, options) {
+function spawn3(cmd, args, options) {
   const proc = childProcess.spawn(cmd, args, {
     stdio: options?.stdio ?? "pipe",
     env: options?.env,
@@ -44005,7 +44246,7 @@ async function question(prompt) {
 }
 async function questionHidden(prompt) {
   closeReadline();
-  const hidden = createInterface({ input: process.stdin, output: new Writable({ write: (_chunk, _encoding, done) => done() }), terminal: true });
+  const hidden = createInterface2({ input: process.stdin, output: new Writable({ write: (_chunk, _encoding, done) => done() }), terminal: true });
   process.stdout.write(prompt);
   return new Promise((resolve) => {
     hidden.question("", (answer) => {
@@ -44136,7 +44377,7 @@ function prepareUploadConfig(opts, rootOpts, shouldUpload, uploadExplicitlyReque
 }
 async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
   spinner.update("Creating remote checkup report");
-  const created = await withRetry(() => createCheckupReport({
+  const created = await withRetry(() => createCheckupReport2({
     apiKey: uploadCfg.apiKey,
     apiBaseUrl: uploadCfg.apiBaseUrl,
     project: uploadCfg.project
@@ -44149,7 +44390,7 @@ async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
   for (const [checkId, report] of Object.entries(reports)) {
     spinner.update(`Uploading ${checkId}.json`);
     const jsonText = JSON.stringify(report, null, 2);
-    const r = await withRetry(() => uploadCheckupReportJson({
+    const r = await withRetry(() => uploadCheckupReportJson2({
       apiKey: uploadCfg.apiKey,
       apiBaseUrl: uploadCfg.apiBaseUrl,
       reportId,
@@ -44290,47 +44531,12 @@ function sanitizeTagForBackup(tag) {
   const stripped = stripMatchingQuotes(tag);
   return /^[A-Za-z0-9._-]{1,64}$/.test(stripped) ? stripped : null;
 }
-function planUpdateTag(current, cliVersion) {
-  const semver = (v) => {
-    const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(v);
-    return m ? { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] } : null;
-  };
-  const cli = semver(cliVersion);
-  if (!cli || cli.pre) {
-    return { tag: null, note: `PGAI_TAG stays ${current ?? "unset"}: this CLI (${cliVersion}) is not a release. To pick a stack version, set PGAI_TAG=<version> in .env and re-run 'postgresai mon update'` };
-  }
-  if (current === cliVersion)
-    return { tag: null, note: `PGAI_TAG is ${cliVersion}, matching this CLI` };
-  const cur = current ? semver(current) : null;
-  if (cur) {
-    const i = cur.core.findIndex((part, j) => part !== cli.core[j]);
-    if (i >= 0 && cur.core[i] > cli.core[i]) {
-      return { tag: null, note: `PGAI_TAG stays ${current}: it is newer than this CLI (${cliVersion}). Upgrade the CLI to move the stack: npm install -g postgresai@latest` };
-    }
-  }
-  return { tag: cliVersion, note: `PGAI_TAG: ${current ?? "unset"} -> ${cliVersion}` };
-}
-var ENV_TAG_LINE = /^([ \t]*(?:export[ \t]+)?PGAI_TAG[ \t]*=[ \t]*)(["']?)([A-Za-z0-9._-]*)\2((?:[ \t]+#[^\r\n]*)?[ \t]*\r?)$/gm;
-var ENV_TAG_ANY = /^[ \t]*(?:export[ \t]+)?PGAI_TAG[ \t]*[=:]/gm;
-function readEnvTag(projectDir) {
+function readDeployedTag(projectDir) {
   const envFile = path9.resolve(projectDir, ".env");
   if (!fs11.existsSync(envFile))
-    return { tag: null, plain: true };
-  const content = fs11.readFileSync(envFile, "utf8");
-  const plainLines = [...content.matchAll(ENV_TAG_LINE)];
-  if (plainLines.length !== [...content.matchAll(ENV_TAG_ANY)].length)
-    return { tag: null, plain: false };
-  const last = plainLines.at(-1);
-  return { tag: last && last[3] ? last[3] : null, plain: true };
-}
-function writeEnvTag(projectDir, tag) {
-  const envFile = path9.resolve(projectDir, ".env");
-  const existing = fs11.existsSync(envFile) ? fs11.readFileSync(envFile, "utf8") : "";
-  const content = new RegExp(ENV_TAG_LINE.source, "m").test(existing) ? existing.replace(ENV_TAG_LINE, (_match, prefix, quote, _value, rest) => `${prefix}${quote}${tag}${quote}${rest}`) : `${existing}${existing && !existing.endsWith(`
-`) ? `
-` : ""}PGAI_TAG=${tag}
-`;
-  writeEnvFile(envFile, content);
+    return null;
+  const m = fs11.readFileSync(envFile, "utf8").match(/^PGAI_TAG=(.+)$/m);
+  return m ? sanitizeTagForBackup(m[1]) : null;
 }
 function isValidComposeYaml(text) {
   const trimmed = text.trim();
@@ -44381,7 +44587,7 @@ async function refreshBundledComposeIfStale(projectDir, oldTag) {
   const existing = fs11.readFileSync(composeFile, "utf8");
   if (composeContentEqual(existing, fetched))
     return false;
-  const deployedTag = sanitizeTagForBackup(oldTag ?? readEnvTag(projectDir).tag);
+  const deployedTag = sanitizeTagForBackup(oldTag ?? readDeployedTag(projectDir));
   const tagPart = deployedTag ?? new Date().toISOString().replace(/[:.]/g, "-");
   const oldHash = crypto2.createHash("sha256").update(existing).digest("hex").slice(0, 8);
   const backup = path9.resolve(projectDir, `docker-compose.yml.bak-${tagPart}-${oldHash}`);
@@ -44431,6 +44637,56 @@ function printResult(result, json) {
 var program2 = new Command2;
 program2.name("postgres-ai").description("PostgresAI CLI").version(package_default.version).option("--api-key <key>", "API key (overrides PGAI_API_KEY)").option("--api-base-url <url>", "API base URL for backend RPC (overrides PGAI_API_BASE_URL)").option("--ui-base-url <url>", "UI base URL for browser routes (overrides PGAI_UI_BASE_URL)").option("--storage-base-url <url>", "Storage base URL for file uploads (overrides PGAI_STORAGE_BASE_URL)");
 program2.showHelpAfterError();
+program2.configureOutput({
+  outputError: (text, write) => jsonConnectArgv() ? writeEvent({ event: "log", level: "error", message: text.trim().replace(/^(error: unknown option ')(--[^=]*|-[^-])[\s\S]*'(?=\n\(Did you mean [^\n]*\)$|$)/, "$1$2'") }) : write(text),
+  writeErr: (text) => void (jsonConnectArgv() || process.stderr.write(text))
+});
+function splitArgv(options, argv) {
+  const operands = [];
+  const unknown = [];
+  let dest = operands;
+  let json = false;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      dest.push(...dest === unknown ? argv.slice(i) : argv.slice(i + 1));
+      break;
+    }
+    const option = options.find((o) => o.long === arg || o.short === arg);
+    if (option) {
+      if (option.required)
+        i++;
+      else if (option.long === "--json")
+        json = true;
+      continue;
+    }
+    if (options.some((o) => o.required && arg.startsWith(`${o.long}=`)))
+      continue;
+    if (dest === operands && arg.length > 1 && arg.startsWith("-"))
+      dest = unknown;
+    dest.push(arg);
+  }
+  return { operands, unknown, json };
+}
+function argvRun(argv = process.argv.slice(2)) {
+  const root = splitArgv(program2.options, argv);
+  let command = program2.commands.find((c) => c.name() === root.operands[0]);
+  let rest = root.unknown;
+  if (root.operands.length === 0) {
+    const end = rest.indexOf("--");
+    const at = rest.slice(0, end < 0 ? undefined : end).indexOf("connect");
+    if (at >= 0)
+      [command, rest] = [program2.commands.find((c) => c.name() === "connect"), rest.slice(at + 1)];
+  }
+  return { command, json: !!command && splitArgv(command.options, rest).json };
+}
+function jsonConnect(command, json) {
+  return command?.parent === program2 && command.name() === "connect" && jsonOutput(json);
+}
+function jsonConnectArgv() {
+  const run = argvRun();
+  return jsonConnect(run.command, run.json);
+}
 program2.addHelpText("after", () => `
 \uD83D\uDCA1 Ideas / feedback: ${FEEDBACK_URL}
 `);
@@ -44452,9 +44708,15 @@ function withOrgOptions(command) {
   ORG_SCOPED_COMMANDS.add(command);
   return command.option("--org <alias>", `organization alias (or ${ORG_ENV}); required with a global token`).option("--org-id <id>", `organization id (or ${ORG_ID_ENV}); alternative to --org`);
 }
-function jsonConnect(command) {
-  return command.parent === program2 && command.name() === "connect" && (!!command.opts().json || !process.stdout.isTTY);
-}
+var restoreConsole;
+program2.hook("preAction", (_thisCommand, actionCommand) => {
+  if (jsonConnect(actionCommand, actionCommand.opts().json))
+    restoreConsole = jsonConsole();
+});
+program2.hook("postAction", () => {
+  restoreConsole?.();
+  restoreConsole = undefined;
+});
 program2.hook("preAction", (_thisCommand, actionCommand) => {
   const initPointsToConnect = actionCommand.parent === program2 && actionCommand.name() === "init" && !interactive(actionCommand.opts().json);
   if (!ORG_SCOPED_COMMANDS.has(actionCommand) || initPointsToConnect) {
@@ -44467,10 +44729,7 @@ program2.hook("preAction", (_thisCommand, actionCommand) => {
     setActiveOrgScope(requireOrgScope(opts, apiKey));
   } catch (err) {
     if (err instanceof OrgScopeError2) {
-      if (jsonConnect(actionCommand))
-        writeEvent({ event: "log", level: "error", message: err.message });
-      else
-        console.error(err.message);
+      console.error(err.message);
       process.exit(1);
     }
     throw err;
@@ -44485,7 +44744,7 @@ program2.command("feedback").description("share ideas or feedback about the CLI"
   if (opts.open) {
     const openCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     try {
-      spawn2(openCommand, [FEEDBACK_URL], { detached: true, stdio: "ignore" }).unref();
+      spawn3(openCommand, [FEEDBACK_URL], { detached: true, stdio: "ignore" }).unref();
     } catch {}
   }
 });
@@ -44692,7 +44951,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
           monitoringUser: opts.monitoringUser,
           includeOptionalPermissions
         });
-        v.missingOptional.push(...await legacyHelperWarnings(supabaseClient));
         if (v.ok) {
           if (jsonOutput) {
             const result = {
@@ -44815,7 +45073,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         client: supabaseClient,
         plan: effectivePlan
       });
-      const legacyWarnings = await legacyHelperWarnings(supabaseClient);
       if (jsonOutput) {
         const result = {
           success: true,
@@ -44825,10 +45082,7 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
           monitoringUser: opts.monitoringUser,
           applied,
           skippedOptional,
-          warnings: [
-            ...skippedOptional.length > 0 ? ["Some optional steps were skipped (not supported or insufficient privileges)"] : [],
-            ...legacyWarnings
-          ]
+          warnings: skippedOptional.length > 0 ? ["Some optional steps were skipped (not supported or insufficient privileges)"] : []
         };
         if (passwordGenerated) {
           result.generatedPassword = monPassword;
@@ -44844,8 +45098,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
           for (const s of skippedOptional)
             console.error(`- ${s}`);
         }
-        for (const w of legacyWarnings)
-          console.error(`\u26A0 ${w}`);
         if (process.stdout.isTTY) {
           console.log(`Applied ${applied.length} steps`);
         }
@@ -44987,7 +45239,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         includeOptionalPermissions,
         provider
       });
-      v.missingOptional.push(...await legacyHelperWarnings(client));
       if (v.ok) {
         if (jsonOutput) {
           outputJson({
@@ -45106,7 +45357,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
       return;
     }
     const { applied, skippedOptional } = await applyInitPlan2({ client, plan: effectivePlan });
-    const legacyWarnings = await legacyHelperWarnings(client);
     if (jsonOutput) {
       const result = {
         success: true,
@@ -45116,10 +45366,7 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         monitoringUser: opts.monitoringUser,
         applied,
         skippedOptional,
-        warnings: [
-          ...skippedOptional.length > 0 ? ["Some optional steps were skipped (not supported or insufficient privileges)"] : [],
-          ...legacyWarnings
-        ]
+        warnings: skippedOptional.length > 0 ? ["Some optional steps were skipped (not supported or insufficient privileges)"] : []
       };
       if (passwordGenerated) {
         result.generatedPassword = monPassword;
@@ -45132,8 +45379,6 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         for (const s of skippedOptional)
           console.error(`- ${s}`);
       }
-      for (const w of legacyWarnings)
-        console.error(`\u26A0 ${w}`);
       if (process.stdout.isTTY) {
         console.log(`Applied ${applied.length} steps`);
       }
@@ -45784,7 +46029,7 @@ function ensureHostMetricsDir(projectDir) {
 }
 function isDockerRunning() {
   try {
-    const result = spawnSync2("docker", ["info"], { stdio: "pipe", timeout: 5000 });
+    const result = spawnSync3("docker", ["info"], { stdio: "pipe", timeout: 5000 });
     return result.status === 0;
   } catch {
     return false;
@@ -45797,7 +46042,7 @@ function shouldScaleOutNodeExporter(args) {
   return !args.slice(upIndex + 1).some((a) => !a.startsWith("-"));
 }
 function getComposeCmd() {
-  const tryCmd = (cmd, args) => spawnSync2(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
+  const tryCmd = (cmd, args) => spawnSync3(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
   if (tryCmd("docker", ["compose", "version"]))
     return ["docker", "compose"];
   if (tryCmd("docker-compose", ["version"]))
@@ -45806,7 +46051,7 @@ function getComposeCmd() {
 }
 function checkRunningContainers() {
   try {
-    const result = spawnSync2("docker", ["ps", "--filter", "name=grafana-with-datasources", "--filter", "name=pgwatch", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf8", timeout: 5000 });
+    const result = spawnSync3("docker", ["ps", "--filter", "name=grafana-with-datasources", "--filter", "name=pgwatch", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf8", timeout: 5000 });
     if (result.status === 0 && result.stdout) {
       const containers = result.stdout.trim().split(`
 `).filter(Boolean);
@@ -45949,10 +46194,10 @@ function updatePgwatchConfig(configPath, updates) {
     console.error(`Warning: could not restrict permissions on ${configPath}: ${message}`);
   }
 }
-function applyApiKey(projectDir, apiKey) {
+function applyApiKey(projectDir, apiKey, opts) {
   const configPath = path9.resolve(projectDir, ".pgwatch-config");
   try {
-    updatePgwatchConfig(configPath, { api_key: apiKey });
+    updatePgwatchConfig(configPath, { api_key: apiKey, api_url: resolveBaseUrls2(opts).apiBaseUrl });
   } catch (err) {
     console.error(`\u2717 ${err instanceof Error ? err.message : String(err)}`);
     return false;
@@ -46151,7 +46396,7 @@ async function runCompose(args, grafanaPassword, extraEnv) {
     finalArgs.push("--scale", "self-node-exporter=0");
   }
   return new Promise((resolve) => {
-    const child = spawn2(cmd[0], [...cmd.slice(1), "-f", composeFile, ...finalArgs], {
+    const child = spawn3(cmd[0], [...cmd.slice(1), "-f", composeFile, ...finalArgs], {
       stdio: "inherit",
       env,
       cwd: projectDir
@@ -46341,7 +46586,7 @@ function emitConnect(result, json) {
   process.exitCode = CONNECT_EXIT[result.status];
 }
 function failCloud(err, json) {
-  printResult({ status: "failed", next: err instanceof Error ? err.message : String(err) }, json);
+  printResult({ status: "failed", next: errorText2(err) }, json);
   process.exitCode = 1;
 }
 function signedIn(opts) {
@@ -46352,22 +46597,8 @@ function signedIn(opts) {
   }
   return !!cloudApi().apiKey;
 }
-function runConnect(url, opts) {
-  return opts.json || !process.stdout.isTTY ? withJsonStderr(() => connectCommand(url, opts, true)) : connectCommand(url, opts, false);
-}
-function runLocalInstall(args, env, json) {
-  if (!json)
-    return Promise.resolve(childProcess.spawnSync(process.execPath, args, { stdio: ["ignore", 2, 2], env }).status);
-  const child = childProcess.spawn(process.execPath, args, { stdio: ["ignore", "pipe", "pipe"], env });
-  for (const stream of [child.stdout, child.stderr]) {
-    createInterface({ input: stream }).on("line", (line) => writeEvent({ event: "log", level: "info", source: "mon local-install", message: line }));
-  }
-  return new Promise((resolve) => {
-    child.on("error", () => resolve(null));
-    child.on("close", (code) => resolve(code));
-  });
-}
-async function connectCommand(url, opts, json) {
+async function runConnect(url, opts) {
+  const json = jsonOutput(opts.json);
   const name = (() => {
     try {
       return databaseName2(url);
@@ -46394,7 +46625,7 @@ async function connectCommand(url, opts, json) {
         const scope = getActiveOrgScope2();
         const org = scope?.alias ? ["--org", scope.alias] : scope?.id ? ["--org-id", String(scope.id)] : [];
         const project = name.replace(/[^A-Za-z0-9._-]+/g, "-");
-        const status = await runLocalInstall([process.argv[1], "mon", "local-install", "-y", ...org, "--project", project], { ...process.env, ...env, PGAI_DB_URL: monitoringUrl, PGAI_API_BASE_URL: api.apiBaseUrl, ...api.apiKey ? { PGAI_API_KEY: api.apiKey } : {} }, json);
+        const status = await runChild(process.execPath, [process.argv[1], "mon", "local-install", "-y", ...org, "--project", project], { ...process.env, ...env, PGAI_DB_URL: monitoringUrl, PGAI_API_BASE_URL: api.apiBaseUrl, ...api.apiKey ? { PGAI_API_KEY: api.apiKey } : {} }, json, "mon local-install");
         if (status !== 0)
           throw new Error("mon local-install failed (see above)");
       },
@@ -46412,31 +46643,32 @@ async function connectCommand(url, opts, json) {
     });
     emitConnect(result, opts.json);
   } catch (err) {
-    emitConnect({ status: "failed", provider, name, next: err instanceof Error ? err.message : String(err) }, opts.json);
+    emitConnect({ status: "failed", provider, name, next: errorText2(err) }, opts.json);
   }
 }
-withOrgOptions(program2.command("connect <database-url>")).configureOutput({
-  writeErr: (text) => {
-    if (!(process.argv.includes("--json") || !process.stdout.isTTY))
-      return void process.stderr.write(text);
-    for (const line of text.split(`
-`).filter((l) => l.trim() !== ""))
-      writeEvent({ event: "log", level: "error", message: line });
-  }
-}).description("put a database under PostgresAI's care: prepare it, provision monitoring, print the dashboard").option("--provider <provider>", "clickhouse | rds | supabase | self-managed (default: detected from the host)").option("--clickhouse-key <id:secret>", "ClickHouse Cloud API key (Basic Service API Reader) for CPU, memory and disk; or CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET").option("--self-hosted", "run the monitoring stack on this machine (mon local-install) instead of PostgresAI Cloud").option("--reset-password", "postgres_ai_mon exists and its password is lost: set a new one (admin URL; refused while another database on the server is monitored)").option("--wait <minutes>", "how long to wait for the monitoring box (0 = do not wait)", "20").option("--coupon <code>", "promotion code for the organization's monitoring subscription (applies when it is first created)").option("-y, --yes", "never prompt: accept the price of a billed box").option("--json", "JSON output (default when stdout is not a TTY)").option("--debug", "print HTTP requests (secrets masked)").addHelpText("after", [
+withOrgOptions(program2.command("connect <database-url>")).description("put a database under PostgresAI's care: prepare it, provision monitoring, print the dashboard").option("--provider <provider>", "clickhouse | rds | supabase | self-managed (default: detected from the host)").option("--clickhouse-key <id:secret>", "ClickHouse Cloud API key (Basic Service API Reader) for CPU, memory and disk; or CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET").option("--self-hosted", "run the monitoring stack on this machine (mon local-install) instead of PostgresAI Cloud").option("--reset-password", "postgres_ai_mon exists and its password is lost: set a new one (admin URL; refused while another database on the server is monitored)").option("--wait <minutes>", "how long to wait for the monitoring box (0 = do not wait)", "20").option("--coupon <code>", "promotion code for the organization's monitoring subscription (applies when it is first created)").option("-y, --yes", "never prompt: accept the price of a billed box").option("--json", "JSON output (default when stdout is not a TTY)").option("--debug", "print HTTP requests (secrets masked)").addHelpText("after", [
   "",
   "Steps (each skipped when already done; safe to re-run): sign in, prepare the database",
   "(an admin URL creates the postgres_ai_mon role; otherwise the SQL is printed), provision",
   "the monitoring box, run the express checkup while it starts, wait, print the dashboard URL.",
   "",
-  'Billing: before a new box, connect shows its price (or "free (N of M free slots)"). A billed',
+  "Billing is per Postgres cluster observed: another database in a cluster the organization already",
+  'monitors is included. Once the URL is checked, connect shows the price (or "free (N of M free slots)"). A billed',
   "box is provisioned only when accepted: at the prompt, or with --yes. With no payment method",
   "it stops (exit 3) and names the console page to add one. --coupon applies a promotion code.",
   "",
   'Exit codes: 0 connected or provisioning, 1 failed, 3 action required (see "next").',
   "",
+  "JSON output (--json, or stdout not a TTY): stdout is the result; stderr is one JSON event a",
+  'line: the steps, and {"event":"log","level":"error"|"warn"|"info"|"debug","message":...}',
+  'for any other text (an error, a warning, --debug); "source":"mon local-install" for that',
+  "child's lines (the logins it prints are masked: pgai mon show-grafana-credentials shows them).",
+  "",
   "Environment: PGAI_API_KEY (instead of signing in), PGAI_MON_PASSWORD (the password of",
-  "postgres_ai_mon when the role already exists; it is checked, never changed),",
+  "postgres_ai_mon when the role already exists; it is checked, never changed; not needed",
+  "for another database on a server PostgresAI already monitors for the org, with",
+  "sslmode=require or verify-* in the URL: PostgresAI fills in the password it keeps (over TLS only), and",
+  "the express checkup is skipped, as it runs only as postgres_ai_mon),",
   "PGPASSWORD (the password for a URL without one),",
   "CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET (instead of --clickhouse-key).",
   "",
@@ -46447,6 +46679,9 @@ withOrgOptions(program2.command("connect <database-url>")).configureOutput({
 ].join(`
 `)).action(runConnect);
 var interactive = (json) => !!process.stdin.isTTY && !!process.stdout.isTTY && !json;
+function jsonOutput(json) {
+  return !!json || !process.stdout.isTTY;
+}
 withOrgOptions(program2.command("init")).description("first run for a person at a terminal: sign in, ask for the database URL, then pgai connect").option("--json", "JSON output (init is interactive: prints the pgai connect command to use instead)").action(async (opts) => {
   if (!interactive(opts.json)) {
     return emitConnect({ status: "action_required", provider: "self-managed", name: "", next: "pgai init is for a person at a terminal; agents and scripts: pgai connect <database-url>" }, opts.json);
@@ -46489,8 +46724,8 @@ withOrgOptions(program2.command("disconnect <name>")).description("stop monitori
     if (!opts.yes && !(process.stdin.isTTY && /^y/i.test(await question(`Disconnect ${row.name} and delete its monitoring box? (y/N): `)))) {
       return emitConnect({ status: "action_required", provider: row.provider, name: row.name, id: row.id, next: `pgai disconnect ${row.name} --yes` }, opts.json);
     }
-    await cloudApi(opts.debug).disconnect(row.id);
-    printResult({ status: "disconnected", name: row.name, id: row.id, next: row.host_metrics ? "Delete the ClickHouse Cloud API key you gave us" : "none" }, opts.json);
+    const billing = disconnectBilling(await cloudApi(opts.debug).disconnect(row.id));
+    printResult({ status: "disconnected", name: row.name, id: row.id, ...billing ? { billing } : {}, next: row.host_metrics ? "Delete the ClickHouse Cloud API key you gave us" : "none" }, opts.json);
   } catch (err) {
     failCloud(err, opts.json);
   }
@@ -46580,7 +46815,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
     if (apiKey) {
       console.log("Using API key provided via --api-key parameter");
       writeConfig({ apiKey });
-      if (!applyApiKey(projectDir, apiKey)) {
+      if (!applyApiKey(projectDir, apiKey, globalOpts)) {
         process.exitCode = 1;
         return;
       }
@@ -46598,7 +46833,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
           const trimmedKey = inputApiKey.trim();
           if (trimmedKey) {
             writeConfig({ apiKey: trimmedKey });
-            if (!applyApiKey(projectDir, trimmedKey)) {
+            if (!applyApiKey(projectDir, trimmedKey, globalOpts)) {
               process.exitCode = 1;
               return;
             }
@@ -47076,9 +47311,9 @@ mon.command("health").description("health check for monitoring services").option
     allHealthy = true;
     for (const service of services) {
       try {
-        const result = spawnSync2("docker", ["inspect", "-f", "{{.State.Status}}", service.container], { stdio: "pipe" });
+        const result = spawnSync3("docker", ["inspect", "-f", "{{.State.Status}}", service.container], { stdio: "pipe" });
         const present = result.status === 0;
-        const health = present && service.readHealth ? (spawnSync2("docker", ["inspect", "-f", "{{if .State.Health}}{{.State.Health.Status}}{{end}}", service.container], { stdio: "pipe" }).stdout || "").trim() : "";
+        const health = present && service.readHealth ? (spawnSync3("docker", ["inspect", "-f", "{{if .State.Health}}{{.State.Health.Status}}{{end}}", service.container], { stdio: "pipe" }).stdout || "").trim() : "";
         const verdict = judgeServiceHealth(service, present, (result.stdout || "").trim(), health);
         console.log(`${verdict.mark} ${service.name}: ${verdict.label}`);
         if (!verdict.ok)
@@ -47172,18 +47407,6 @@ mon.command("update").description("update monitoring stack (migrate .env, pull i
     } else {
       console.log("\u2713 .env is up to date");
     }
-    const envTag = readEnvTag(projectDir);
-    const deployedTag = envTag.tag;
-    const tagPlan = envTag.plain ? planUpdateTag(deployedTag, package_default.version) : { tag: null, note: `PGAI_TAG in .env is not a plain value, so it is left as is. To move the stack to ${package_default.version}, set PGAI_TAG=${package_default.version} in .env and re-run 'postgresai mon update'` };
-    if (process.env.PGAI_TAG && process.env.PGAI_TAG !== (tagPlan.tag ?? deployedTag)) {
-      console.error(`\u26A0 PGAI_TAG=${process.env.PGAI_TAG} is set in the environment, and docker compose prefers it over .env: unset it before 'postgresai mon stop && postgresai mon start'`);
-    }
-    if (tagPlan.tag) {
-      writeEnvTag(projectDir, tagPlan.tag);
-      if (process.env.PGAI_TAG === deployedTag)
-        process.env.PGAI_TAG = tagPlan.tag;
-    }
-    console.log(`${tagPlan.tag ? "\u2713 " : ""}${tagPlan.note}`);
     console.log();
     const gitDir = path9.resolve(projectDir, ".git");
     if (fs11.existsSync(gitDir)) {
@@ -47197,7 +47420,7 @@ mon.command("update").description("update monitoring stack (migrate .env, pull i
       console.log(pullOut);
     } else {
       console.log("(not a git checkout \u2014 checking bundled docker-compose.yml)");
-      await refreshBundledComposeIfStale(projectDir, deployedTag);
+      await refreshBundledComposeIfStale(projectDir);
     }
     console.log(`
 Updating Docker images...`);
@@ -47217,7 +47440,7 @@ Updating Docker images...`);
 \u2713 Update completed successfully`);
       console.log(`
 To apply updates, restart monitoring services:`);
-      console.log("  postgresai mon stop && postgresai mon start");
+      console.log("  postgres-ai mon restart");
     } else {
       console.error(`
 \u2717 Docker image update failed`);
@@ -47358,7 +47581,7 @@ async function sinkPrometheusMaybeUp() {
   } catch {
     return true;
   }
-  const ps = spawnSync2(cmd[0], [...cmd.slice(1), "-f", composeFile, "ps", "-a", "-q", "--status", "running", "--status", "paused", "sink-prometheus"]);
+  const ps = spawnSync3(cmd[0], [...cmd.slice(1), "-f", composeFile, "ps", "-a", "-q", "--status", "running", "--status", "paused", "sink-prometheus"]);
   return ps.status !== 0 || ps.stdout.trim() !== "";
 }
 async function reloadHostMetrics(projectDir, job, file) {
@@ -47393,14 +47616,36 @@ async function reloadHostMetrics(projectDir, job, file) {
   }
   return true;
 }
+var CONN_STR_FORMAT = "Invalid connection string format: use postgresql://user:password@host[:port]/database";
 function defaultTargetName(connStr) {
+  if (!/^postgres(ql)?:\/\//.test(connStr))
+    return { error: CONN_STR_FORMAT };
+  if (/[\x00-\x1f\x7f]/.test(connStr))
+    return { error: "Invalid connection string format: remove the control character (such as a CR from a CRLF file), or percent-encode it" };
+  const at = connStr.lastIndexOf("@");
+  if (at < 0)
+    return { error: CONN_STR_FORMAT };
+  if (!/^(?:[A-Za-z0-9\-._~!$&'()*+,;=:@]|%[0-9A-Fa-f]{2})*$/.test(connStr.slice(connStr.indexOf("//") + 2, at))) {
+    return { error: "Invalid connection string format: percent-encode the user name and the password (all but ASCII letters, digits, '-', '.', '_' and '~'), and an '@' in the database name or the query" };
+  }
+  let url;
   try {
-    new URL(connStr);
+    url = new URL(connStr);
   } catch {
-    return null;
-  }
-  const m = connStr.match(/^postgres(?:ql)?:\/\/[^:]+:[^@]+@([^:\/]+)(?::\d+)?\/([^?]+)/);
-  return m ? `${m[1]}-${m[2]}`.replace(/[^a-zA-Z0-9-]/g, "-") : null;
+    return { error: CONN_STR_FORMAT };
+  }
+  if (!url.username)
+    return { error: CONN_STR_FORMAT };
+  if (/%3a/i.test(url.username))
+    return { error: "Invalid connection string format: percent-encode the user name and the password one at a time, with a raw ':' between them" };
+  if (!url.password)
+    return { error: "Invalid connection string format: put the password in the URL: postgresql://user:password@host[:port]/database" };
+  if (url.hostname.includes(":"))
+    return { error: "Invalid connection string format: an IPv6 address is not supported as the host; use a host name" };
+  const db = url.pathname.slice(1);
+  if (!db)
+    return { error: CONN_STR_FORMAT };
+  return { name: `${url.hostname}-${db}`.replace(/[^a-zA-Z0-9-]/g, "-") };
 }
 function parseEnvValue(content, key) {
   const last = [...content.matchAll(new RegExp(`^[ \\t]*(?:export[ \\t]+)?${key}=(.*)$`, "gm"))].at(-1);
@@ -47445,7 +47690,7 @@ async function setRdsHostStats(projectDir, values) {
   if (!cmd)
     return true;
   const { composeFile } = await resolveOrInitPaths();
-  const ps = spawnSync2(cmd[0], [...cmd.slice(1), "-f", composeFile, "--profile", "rds", "ps", "-q", "--status", "running", "rds-host-stats"]);
+  const ps = spawnSync3(cmd[0], [...cmd.slice(1), "-f", composeFile, "--profile", "rds", "ps", "-q", "--status", "running", "rds-host-stats"]);
   if (ps.status !== 0) {
     console.error("If rds-host-stats is running, recreate it: docker compose --profile rds up -d rds-host-stats");
     return true;
@@ -47530,6 +47775,7 @@ async function syncVmalert(projectDir, apply, addOnly = false) {
   return true;
 }
 var looksLikeConnStr = (value) => /^postgres(ql)?:\/\//i.test(value);
+var isPlainTargetName = (value) => /^[A-Za-z0-9._=-]+$/.test(value) && !/(password|pwd)\s*=/i.test(value);
 async function addTarget(file, projectDir, connStr, name, env, { apply = true } = {}) {
   if (!connStr) {
     console.error("Connection string required: postgresql://user:pass@host:port/db");
@@ -47539,15 +47785,15 @@ async function addTarget(file, projectDir, connStr, name, env, { apply = true }
   const channelBinding = splitChannelBinding2(connStr);
   connStr = channelBinding.uri;
   const defaultName = defaultTargetName(connStr);
-  if (!defaultName) {
-    console.error("Invalid connection string format");
+  if ("error" in defaultName) {
+    console.error(defaultName.error);
     process.exitCode = 1;
     return false;
   }
   if (channelBinding.value !== null) {
     console.error("Note: removed channel_binding from the connection string; the collector does not support it (TLS is kept)");
   }
-  const instanceName = name && name.trim() ? name.trim() : defaultName;
+  const instanceName = name && name.trim() ? name.trim() : defaultName.name;
   if (detectProvider(connStr) !== "clickhouse" && extractProjectRefFromUrl(connStr) && supabaseHostMetricsOn(projectDir, env) && !SUPABASE_TARGET_NAME_RE.test(instanceName)) {
     console.error(SUPABASE_TARGET_NAME_ERROR);
     process.exitCode = 1;
@@ -47630,14 +47876,40 @@ Supabase: with PGAI_SUPABASE_HOST_METRICS=true (environment or .env), writes hos
 RDS instance endpoint: writes RDS_DB_INSTANCE_IDENTIFIER, AWS_REGION, PGAI_CLUSTER and PGAI_NODE_NAME to .env for rds-host-stats.
 
 Environment:
-  PGAI_DB_URL  the connection string, when none is given (keeps the password out of argv);
-               the only argument is then the name: PGAI_DB_URL=... postgres-ai mon targets add my-db
+  PGAI_DB_URL  the connection string, unless a postgres:// or postgresql:// URL is given
+               (keeps the password out of argv). The only argument is then the name, of
+               ASCII letters, digits, '.', '_', '=' and '-', with no password= or pwd=;
+               anything else is refused. Set it for this command only:
+                 PGAI_DB_URL='postgresql://user:pass@host:5432/db' postgres-ai mon targets add my-db
+               Under sudo, pass it on stdin: sudo logs a variable kept with --preserve-env.
+                 printf '%s\\n' "$URL" | sudo sh -c \\
+                   'IFS= read -r PGAI_DB_URL; export PGAI_DB_URL; exec postgres-ai mon targets add my-db'
+               sudo I/O logging (log_input in sudoers) records stdin: then read it from a
+               file of mode 0600 in the root shell.
+                 sudo sh -c \\
+                   'IFS= read -r PGAI_DB_URL < /path/to/db-url; export PGAI_DB_URL; exec postgres-ai mon targets add my-db'
 `).action(async (connStr, name) => {
   const { instancesFile: file, projectDir } = await resolveOrInitPaths();
   const envUrl = process.env.PGAI_DB_URL || undefined;
+  delete process.env.PGAI_DB_URL;
   if (envUrl && name === undefined && (connStr === undefined || !looksLikeConnStr(connStr))) {
-    name = connStr;
+    const arg = connStr?.trim();
+    if (arg && !isPlainTargetName(arg)) {
+      console.error("PGAI_DB_URL is set: pass only the target name (ASCII letters, digits, '.', '_', '=', '-'; no password= or pwd=)");
+      process.exitCode = 1;
+      return;
+    }
+    name = arg;
     connStr = envUrl;
+    let user = "";
+    if (!("error" in defaultTargetName(splitChannelBinding2(envUrl).uri))) {
+      try {
+        user = decodeURIComponent(new URL(envUrl).username);
+      } catch {
+        user = new URL(envUrl).username;
+      }
+    }
+    console.error(`Using PGAI_DB_URL${user ? ` (user ${user})` : ""}`);
   }
   await addTarget(file, projectDir, connStr, name, process.env);
 });
@@ -47838,7 +48110,7 @@ Opening browser for authentication...`);
 ${authUrl}
 `);
     const openCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    const browserProcess = spawn2(openCommand, [authUrl], { detached: true, stdio: "ignore" });
+    const browserProcess = spawn3(openCommand, [authUrl], { detached: true, stdio: "ignore" });
     browserProcess.on("error", () => {});
     browserProcess.unref();
     console.log("Waiting for authorization...");
@@ -49547,10 +49819,9 @@ export {
   monitoringHealthServices,
   persistInstanceId,
   planMonitoringRegistration,
-  planUpdateTag,
   program2 as program,
   readComposeProfiles,
-  readEnvTag,
+  readDeployedTag,
   refreshBundledComposeIfStale,
   registerMonitoringInstance,
   resolveAdoptedProject,
@@ -49558,6 +49829,5 @@ export {
   selfRegisterAndPersist,
   shouldScaleOutNodeExporter,
   statOwner,
-  updatePgwatchConfig,
-  writeEnvTag
+  updatePgwatchConfig
 };