postgresai 0.17.0-dev.8 → 0.17.0-dev.9

package/README.md

@@ -140,10 +140,20 @@ Before any grant runs, one `-- scope:` line lists exactly what the run grants th
 monitoring role, derived from the steps about to run (so it shrinks under `--skip-optional-permissions`
 and is not printed on `--reset-password`, which grants nothing). With `--json` it goes to stderr.
 
-`channel_binding=require` in a URI or conninfo string enables SCRAM-SHA-256-PLUS when the server
+For `prepare-db`, `channel_binding=require` in a URI or conninfo string enables SCRAM-SHA-256-PLUS when the server
 offers it, disables the plaintext retry that `sslmode=prefer` would otherwise do, and is rejected
 together with `sslmode=disable`. The mechanism actually negotiated is not enforced by the driver.
 
+The collector cannot do channel binding. `mon targets add`, `mon local-install --db-url`, and
+`pgai connect` remove `channel_binding` from the saved/box URL. With `require`, they refuse
+`sslmode=disable` or `allow`; keep `verify-full` with a warning; and upgrade `require`, `prefer`,
+`verify-ca` or unset to `verify-full` after testing certificate and hostname verification with
+Node's default trust store (or the CA file in `sslrootcert`). Authentication or other errors after
+a verified TLS handshake do not block the upgrade. If verification fails, provide
+`sslrootcert=<CA file>` with `sslmode=verify-full`, or explicitly accept the downgrade by removing
+`channel_binding=require`. Successful upgrades print the collector warning and
+`upgraded to sslmode=verify-full`. `channel_binding=prefer` or `disable` is removed with a note.
+
 ### ClickHouse Cloud host metrics
 
 For a ClickHouse Managed Postgres target, `mon local-install --db-url` and `mon targets add` also set up
@@ -215,9 +225,13 @@ terminal, or with `--json`, it only points to `pgai connect`.
 | `--self-hosted` | run the stack on this machine (`mon local-install`) instead of PostgresAI Cloud |
 | `--reset-password` | `postgres_ai_mon` exists and its password is lost: set a new one (see below) |
 | `--wait <minutes>` | how long to wait for the monitoring box; `0` does not wait (default 20) |
-| `-y, --yes` | never prompt (`connect` does not start the browser sign-in; `disconnect` does not ask) |
+| `-y, --yes` | never prompt; accept a billed box's price (`connect` does not start the browser sign-in; `disconnect` does not ask) |
+| `--coupon <code>` | promotion code for the organization's monitoring subscription |
 | `--json` | JSON output, also on a terminal |
 
+Without `--yes`, a non-interactive run for a billed box returns `action_required` with the price
+and asks you to re-run with `--yes` to accept it.
+
 | Environment | |
 |---|---|
 | `PGAI_API_KEY` | the API key, instead of signing in (agents, CI) |
@@ -250,13 +264,19 @@ used: set `PGAI_MON_PASSWORD`, or turn TLS on; if nobody has the password, disco
 other databases, then `--reset-password` with `PGAI_MON_PASSWORD` set to a new one, and connect
 them again with it (`connect` names them).
 
-When the role exists (an admin URL with `PGAI_MON_PASSWORD`, or the role's own URL), `connect`
-also logs in once as `postgres_ai_mon` with a random password, to learn whether the server checks
-passwords for this host at all. On a server that does, this is one
-`password authentication failed for user "postgres_ai_mon"` line in the server log per run, and it
-counts toward failed-login policies (credcheck, fail2ban). On a server that does not (`trust`),
-`next` says that the password was not checked; a password from `PGPASSWORD` is then not used:
-put it in the URL.
+When preparing an existing role with a supplied password (an admin URL with `PGAI_MON_PASSWORD`,
+or the role's own URL), `connect` also tries a random password as `postgres_ai_mon` to learn
+whether the server checks passwords for this host. Successful PostgresAI Cloud preparation makes
+two attempts: one in the check before the price, and one in preparation. Stopping after the check
+(for example, without accepting the price) makes one. Successful `--self-hosted` preparation
+makes one. Creating or resetting the role with an admin URL, using the platform's stored password,
+or returning an existing box's status makes no random-password attempts. A rejected supplied
+password stops before the random-password probe; that rejection is itself a failed login.
+On a server that checks passwords, each random-password attempt adds one
+`password authentication failed for user "postgres_ai_mon"` line to the server log and counts
+toward failed-login policies (credcheck, fail2ban). On a server that does not (`trust`), `next`
+says that the password was not checked; a password from `PGPASSWORD` is then not used: put it
+in the URL.
 
 A role that is not a superuser creates `postgres_ai_mon` only if it can run the whole
 preparation: `CREATEROLE`, `CREATE` on the database, `pg_stat_statements` already installed, and
@@ -264,7 +284,8 @@ on PostgreSQL 16+ `ADMIN OPTION` on `pg_monitor` and `pg_read_all_stats`. Otherw
 printed and nothing is created.
 
 The host and the port are the ones in the URL: `host` or `port` in the query string is refused.
-Of the query string, the monitoring box gets `sslmode`, `channel_binding` and `application_name`.
+Of the query string, the monitoring box gets `sslmode` and `application_name`; `channel_binding`
+is removed using the collector rule above, before a price is quoted or anything is changed.
 Certificate files (`sslrootcert`, `sslcert`, `sslkey`) are used for the connections from this
 machine only; with `sslmode=verify-ca` or `verify-full` and a private CA in `sslrootcert`, `next`
 says that the box has no copy of that CA.
@@ -506,7 +527,7 @@ Tools exposed:
 - `update_issue_comment`: update an existing comment (args: `{ comment_id, org_id, content?, attachments?, debug? }`).
 - `upload_file`: upload a local file and return the storage URL plus a ready-to-paste markdown link (args: `{ path, org_id, debug? }`).
 - `download_file`: download a file from storage (args: `{ url, org_id, output_path?, debug? }`).
-- `connect_database`: `pgai connect` as a tool (args: `{ database_url, org_id, provider?, clickhouse_key?, debug? }`). Returns the same JSON (`status`: `connected`, `provisioning`, `disconnecting`, `action_required` or `failed`; `dashboard_url`; `next`). It does not wait for the monitoring box: call it again to see the status. `database_url` must carry its password, and only the query parameters `sslmode`, `channel_binding`, `application_name` (and `password`); `PGAI_MON_PASSWORD`, `PGPASSWORD` and `CLICKHOUSE_KEY_ID` + `CLICKHOUSE_KEY_SECRET` of the server process are not used, a TLS failure is not retried in plaintext, and `--self-hosted` is CLI-only. For another database on a server PostgresAI already monitors for the organization, an admin `database_url` with `sslmode=require` (or `verify-*`) is enough: PostgresAI fills in the password of `postgres_ai_mon` it keeps.
+- `connect_database`: `pgai connect` as a tool (args: `{ database_url, org_id, provider?, clickhouse_key?, yes?, coupon?, debug? }`). Returns the same JSON (`status`: `connected`, `provisioning`, `disconnecting`, `action_required` or `failed`; `dashboard_url`; `next`). For a billed box, the tool first returns the price with `action_required`; an explicit call with `yes: true` accepts it. `coupon` supplies a promotion code. It does not wait for the monitoring box: call it again to see the status. `database_url` must carry its password, and only the query parameters `sslmode`, `channel_binding`, `application_name` (and `password`); `PGAI_MON_PASSWORD`, `PGPASSWORD` and `CLICKHOUSE_KEY_ID` + `CLICKHOUSE_KEY_SECRET` of the server process are not used, a TLS failure is not retried in plaintext, and `--self-hosted` is CLI-only. For another database on a server PostgresAI already monitors for the organization, an admin `database_url` with `sslmode=require` (or `verify-*`) is enough: PostgresAI fills in the password of `postgres_ai_mon` it keeps.
 
 #### `attachments` parameter (issue/comment tools)
 

package/dist/bin/postgres-ai.js

@@ -13533,7 +13533,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-dev.8",
+  version: "0.17.0-dev.9",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16893,7 +16893,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-dev.8";
+var version = "0.17.0-dev.9";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -18501,6 +18501,13 @@ var Result2 = import_lib2.default.Result;
 var TypeOverrides2 = import_lib2.default.TypeOverrides;
 var defaults2 = import_lib2.default.defaults;
 
+// node_modules/pg-connection-string/esm/index.mjs
+var import___ = __toESM(require_pg_connection_string(), 1);
+var esm_default = import___.default.parse;
+var parse = import___.default.parse;
+var toClientConfig = import___.default.toClientConfig;
+var parseIntoClientConfig = import___.default.parseIntoClientConfig;
+
 // lib/checkup.ts
 import * as fs4 from "fs";
 import * as path4 from "path";
@@ -22577,12 +22584,13 @@ async function generateD004(client, nodeName) {
   let pgssError = null;
   const pgssSampleQueries = [];
   try {
-    const extCheck = await client.query("select 1 from pg_extension where extname = 'pg_stat_statements'");
+    const extCheck = await client.query("select n.nspname as schema from pg_catalog.pg_extension e join pg_catalog.pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'");
     if (extCheck.rows.length > 0) {
       pgssAvailable = true;
+      const pgssView = quoteIdent(extCheck.rows[0].schema, "pg_stat_statements");
       const statsResult = await client.query(`
         select count(*) as cnt, coalesce(sum(calls), 0) as total_calls
-        from pg_stat_statements
+        from ${pgssView}
       `);
       pgssMetricsCount = parseInt(statsResult.rows[0]?.cnt || "0", 10);
       pgssTotalCalls = parseInt(statsResult.rows[0]?.total_calls || "0", 10);
@@ -22592,7 +22600,7 @@ async function generateD004(client, nodeName) {
           coalesce(usename, 'unknown') as "user",
           coalesce(datname, 'unknown') as database,
           calls
-        from pg_stat_statements s
+        from ${pgssView} s
         left join pg_database d on s.dbid = d.oid
         left join pg_user u on s.userid = u.usesysid
         order by calls desc
@@ -22620,16 +22628,17 @@ async function generateD004(client, nodeName) {
   let kcacheError = null;
   const kcacheSampleQueries = [];
   try {
-    const extCheck = await client.query("select 1 from pg_extension where extname = 'pg_stat_kcache'");
+    const extCheck = await client.query("select n.nspname as schema from pg_catalog.pg_extension e join pg_catalog.pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_kcache'");
     if (extCheck.rows.length > 0) {
       kcacheAvailable = true;
+      const kcacheView = quoteIdent(extCheck.rows[0].schema, "pg_stat_kcache");
       const statsResult = await client.query(`
         select
           count(*) as cnt,
           coalesce(sum(exec_user_time + exec_system_time), 0) as total_exec_time,
           coalesce(sum(exec_user_time), 0) as total_user_time,
           coalesce(sum(exec_system_time), 0) as total_system_time
-        from pg_stat_kcache
+        from ${kcacheView}
       `);
       kcacheMetricsCount = parseInt(statsResult.rows[0]?.cnt || "0", 10);
       kcacheTotalExecTime = parseFloat(statsResult.rows[0]?.total_exec_time || "0");
@@ -22640,7 +22649,7 @@ async function generateD004(client, nodeName) {
           queryid::text as queryid,
           coalesce(usename, 'unknown') as "user",
           (exec_user_time + exec_system_time) as exec_total_time
-        from pg_stat_kcache k
+        from ${kcacheView} k
         left join pg_user u on k.userid = u.usesysid
         order by (exec_user_time + exec_system_time) desc
         limit 5
@@ -27216,15 +27225,6 @@ import * as path5 from "path";
 
 // lib/instances.ts
 import * as fs5 from "fs";
-
-// node_modules/pg-connection-string/esm/index.mjs
-var import___ = __toESM(require_pg_connection_string(), 1);
-var esm_default = import___.default.parse;
-var parse = import___.default.parse;
-var toClientConfig = import___.default.toClientConfig;
-var parseIntoClientConfig = import___.default.parseIntoClientConfig;
-
-// lib/instances.ts
 class InstancesParseError extends Error {
   constructor(file, cause) {
     const yamlErr = cause;
@@ -27254,7 +27254,68 @@ function loadInstances(file) {
   }
   return parsed;
 }
+function extractSslmode(connStr) {
+  try {
+    return (new URL(connStr).searchParams.get("sslmode") || "").toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function sslOptionFromSslmode(sslmode) {
+  switch (sslmode) {
+    case "disable":
+      return false;
+    case "verify-ca":
+      return { rejectUnauthorized: true, checkServerIdentity: () => {
+        return;
+      } };
+    case "verify-full":
+      return { rejectUnauthorized: true };
+    case "allow":
+    case "prefer":
+    case "require":
+    case "no-verify":
+    case "":
+    default:
+      return { rejectUnauthorized: false };
+  }
+}
 var LAX_SSLMODES = new Set(["", "allow", "prefer", "require"]);
+function buildClientConfig(connStr, extra = {}) {
+  const sslmode = extractSslmode(connStr);
+  const channelBinding = splitChannelBinding(connStr);
+  const enableChannelBinding = requireChannelBinding(channelBinding.value, sslmode === "disable");
+  const parsed = parse(withoutSslmode(channelBinding.uri));
+  return {
+    host: parsed.host || undefined,
+    port: parsed.port ? Number(parsed.port) : undefined,
+    user: parsed.user,
+    password: parsed.password,
+    database: databaseName(withoutSslmode(channelBinding.uri), parsed.database),
+    ssl: sslOptionFromSslmode(sslmode),
+    ...enableChannelBinding ? { enableChannelBinding: true } : {},
+    ...extra
+  };
+}
+function databaseName(connStr, parsed) {
+  if (!parsed)
+    return;
+  try {
+    const u = new URL(connStr);
+    if (/^postgres(ql)?:$/.test(u.protocol))
+      return decodeURIComponent(u.pathname.slice(1));
+  } catch {}
+  return parsed;
+}
+function withoutSslmode(connStr) {
+  try {
+    const u = new URL(connStr);
+    u.searchParams.delete("sslmode");
+    return u.toString();
+  } catch {
+    return connStr;
+  }
+}
 function splitChannelBinding(uri) {
   let value = null;
   try {
@@ -27268,6 +27329,47 @@ function splitChannelBinding(uri) {
   const params = uri.slice(start + 1, end).split("&").filter((param) => !new URLSearchParams(param).has("channel_binding"));
   return { uri: uri.slice(0, start) + (params.length ? `?${params.join("&")}` : "") + uri.slice(end), value };
 }
+async function verifyCollectorTls(url) {
+  const u = new URL(url);
+  const ca = u.searchParams.get("sslrootcert");
+  for (const key of ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"])
+    u.searchParams.delete(key);
+  const client = new Client2({
+    ...buildClientConfig(splitChannelBinding(u.toString()).uri, { connectionTimeoutMillis: 1e4 }),
+    ssl: { rejectUnauthorized: true, servername: u.hostname, ...ca ? { ca: fs5.readFileSync(ca, "utf8") } : {} }
+  });
+  try {
+    await client.connect();
+  } catch (err) {
+    if (!client.connection.stream.authorized)
+      throw err;
+  } finally {
+    await client.end().catch(() => {});
+  }
+}
+async function collectorConnection(url, verifyTls = verifyCollectorTls) {
+  const binding = splitChannelBinding(url);
+  const sslmode = extractSslmode(url);
+  if (binding.value === "require") {
+    if (sslmode === "disable" || sslmode === "allow") {
+      throw new Error(`channel_binding=require needs TLS, but sslmode=${sslmode} is set`);
+    }
+    let collectorUrl = binding.uri;
+    if (sslmode !== "verify-full") {
+      const u = new URL(collectorUrl);
+      u.searchParams.set("sslmode", "verify-full");
+      collectorUrl = u.toString();
+      try {
+        await verifyTls(collectorUrl);
+      } catch (err) {
+        const why = err instanceof Error && err.message ? ` (${err.message})` : "";
+        throw new Error(`Could not verify the TLS certificate for channel_binding=require${why}. Provide sslrootcert=<CA file> with sslmode=verify-full, or explicitly accept the downgrade by removing channel_binding=require from the URL`);
+      }
+    }
+    return { url: collectorUrl, note: "the collector can't do channel binding; it connects with TLS and full certificate verification" + (sslmode !== "verify-full" ? "; upgraded to sslmode=verify-full" : "") };
+  }
+  return { url: binding.uri, ...binding.value !== null ? { note: "removed channel_binding from the connection string; the collector does not support it (TLS is kept)" } : {} };
+}
 function requireChannelBinding(value, sslDisabled) {
   if (value !== "require")
     return false;
@@ -28005,7 +28107,7 @@ function detectCloudProvider(url) {
     return "supabase";
   return "self-managed";
 }
-function databaseName(url) {
+function databaseName2(url) {
   const u = new URL(url);
   const port = u.port && u.port !== "5432" ? `:${u.port}` : "";
   let db = decodeURIComponent(u.pathname.replace(/^\//, ""));
@@ -28046,15 +28148,33 @@ function clusterOf(url) {
   return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
 }
 var errorText = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText).join("; ") : err instanceof Error ? err.message : String(err);
-var urlPassword = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
+var urlPassword = (u) => {
+  for (const key of [...u.searchParams.keys()])
+    if (key !== "password")
+      u.searchParams.delete(key);
+  return parse(u.toString()).password || "";
+};
 var URL_PARAMS_KEPT = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
 function checkUrlParams(url, agent) {
-  const keys = [...new Set(new URL(url).searchParams.keys())];
+  const u = new URL(url);
+  const keys = [...new Set(u.searchParams.keys())];
   if (agent) {
+    for (const key of ["password", "user", "host", "port", "dbname"]) {
+      if (u.searchParams.getAll(key).length > 1)
+        throw new Error(`database_url query parameter ${key} must appear only once`);
+    }
+    if (u.password && u.searchParams.has("password"))
+      throw new Error("database_url must give the password only once, in the authority or in ?password=");
     const refused = keys.filter((k) => k !== "password" && !URL_PARAMS_KEPT.includes(k));
     if (refused.length)
       throw new Error(`database_url may carry only these query parameters: ${URL_PARAMS_KEPT.join(", ")} (got: ${refused.join(", ")})`);
+    u.searchParams.delete("sslmode");
+    u.searchParams.delete("channel_binding");
+    const config = parseIntoClientConfig(u.toString());
+    if (!/^postgres(ql)?:$/.test(u.protocol) || typeof config.password !== "string" || !config.password)
+      throw new Error("database_url must be postgresql://user:password@host:5432/dbname, with the password in it");
+    return { ...config, password: config.password };
   }
   const moved = keys.filter((k) => k === "host" || k === "port");
   if (moved.length)
@@ -28087,7 +28207,7 @@ function roleUrlFor(url, db, password, kept) {
   u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
-var monitoringUrlFor = (url, db, password) => roleUrlFor(url, db, password, URL_PARAMS_KEPT);
+var monitoringUrlFor = (url, db, password) => roleUrlFor(url, db, password, URL_PARAMS_KEPT.filter((p) => p !== "channel_binding"));
 var loginUrlFor = (url, db, password) => roleUrlFor(url, db, password, [...URL_PARAMS_KEPT, ...URL_PARAMS_TLS]);
 function caNote(url) {
   const q = new URL(url).searchParams;
@@ -28163,7 +28283,19 @@ async function connect(url, opts, deps) {
   if (!PROVIDERS.includes(provider))
     throw new Error(`--provider must be one of: ${PROVIDERS.join(", ")}`);
   checkUrlParams(url, opts.agent);
-  const name = databaseName(url);
+  const name = databaseName2(url);
+  try {
+    const collector = await collectorConnection(url, deps.verifyTls);
+    const required = splitChannelBinding(url).value === "require";
+    url = collector.url;
+    if (collector.note)
+      progress("preparing", `${required ? "Warning" : "Note"}: ${collector.note}`);
+    if (required && caNote(url))
+      progress("preparing", `Note: ${caNote(url)}`);
+  } catch (err) {
+    return { status: "action_required", provider, name, next: err instanceof Error ? err.message : String(err) };
+  }
+  const cluster = clusterOf(url);
   const key = parseClickhouseKey(opts.clickhouseKey, provider === "clickhouse" && !opts.agent ? process.env : {});
   if (key && provider !== "clickhouse")
     throw new Error("--clickhouse-key applies to ClickHouse Managed Postgres only");
@@ -28176,8 +28308,12 @@ async function connect(url, opts, deps) {
   if (opts.selfHosted && deps.localStackRunning()) {
     return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
+  const findDatabase = (list) => {
+    const live = list.filter((d) => !disconnecting(d.status));
+    return live.find((d) => d.cluster === cluster && d.database != null && decodeURIComponent(d.database) === name.split("/").slice(1).join("/")) ?? live.find((d) => (d.cluster == null || d.database == null) && d.name === name);
+  };
   const rows = opts.selfHosted ? [] : await deps.list();
-  let row = rows.find((d) => d.name === name && !disconnecting(d.status));
+  let row = findDatabase(rows);
   const fresh = !row;
   let note = "";
   let checkup;
@@ -28219,9 +28355,10 @@ async function connect(url, opts, deps) {
         await deps.unprepare(url).catch(() => false);
     };
     let lockId;
-    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
-    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting(d.status) && (unread(d) || serverOf(d.name) === serverOf(name)));
-    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf(d.name) === serverOf(name)) || undefined;
+    const unread = (d) => !d.cluster && !/^[A-Za-z0-9._\[\]:-]{1,253}(?::[0-9]+)?(?:\/[A-Za-z0-9._-]*)?$/.test(d.name);
+    const onServer = (d) => d.cluster ? d.cluster === cluster : !unread(d) && serverOf(d.name) === serverOf(name);
+    const othersOnServer = (list) => list.filter((d) => !disconnecting(d.status) && (unread(d) || onServer(d)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && onServer(d)) || undefined;
     const cutOff = (others) => {
       const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
       const maybe = others.filter(unread).map((d) => d.name).join(", ");
@@ -28242,8 +28379,13 @@ async function connect(url, opts, deps) {
     const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
     if (!opts.selfHosted) {
       const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
-      if ("next" in probe)
-        return { status: "action_required", provider, name, ...probe };
+      if ("next" in probe) {
+        const { resettable, ...refusal } = probe;
+        if (resettable && !opts.resetPassword && !opts.agent && await deps.confirm("A monitoring role from an earlier connection exists, and its password isn't stored. Reset it now? Anything else using this role will need the new password. [y/N] ")) {
+          return connect(url, { ...opts, resetPassword: true }, deps);
+        }
+        return { status: "action_required", provider, name, ...refusal };
+      }
       const b = await billingFor(await deps.quote(opts.coupon, clusterOf(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
       if (b.stop)
         return { status: "action_required", provider, name, ...b.stop };
@@ -28252,10 +28394,10 @@ async function connect(url, opts, deps) {
     if (opts.resetPassword) {
       let lock;
       try {
-        lock = await deps.resetLock(serverOf(name));
+        lock = await deps.resetLock(cluster);
       } catch (err) {
         if (err instanceof HttpStatusError && err.status === 409) {
-          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${cluster} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
         }
         if (err instanceof HttpStatusError && err.status === 404) {
           return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
@@ -28272,7 +28414,7 @@ async function connect(url, opts, deps) {
     try {
       if (lockId) {
         const now = await deps.list();
-        const same = now.find((d) => d.name === name && !disconnecting(d.status));
+        const same = findDatabase(now);
         if (same)
           return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
         const others = othersOnServer(now);
@@ -28281,8 +28423,10 @@ async function connect(url, opts, deps) {
       }
       progress("preparing", `Preparing ${maskConnectionString(url)}`);
       prepared = await deps.prepare(url, provider, prepOpts);
-      if ("next" in prepared)
-        return { status: "action_required", provider, name, ...billing, ...prepared };
+      if ("next" in prepared) {
+        const { resettable, ...refusal } = prepared;
+        return { status: "action_required", provider, name, ...billing, ...refusal };
+      }
       if (!("monitoringUrl" in prepared))
         throw new Error("prepare returned no monitoring URL");
       if (prepared.note)
@@ -28343,8 +28487,9 @@ async function connect(url, opts, deps) {
   }
   let shown;
   for (const deadline = deps.now() + opts.waitMs;; ) {
-    if (undoRole && row.billing_error && disconnecting(row.status)) {
-      await undoRole();
+    if (row.billing_error && disconnecting(row.status)) {
+      if (undoRole)
+        await undoRole();
       return {
         status: "action_required",
         provider,
@@ -28352,7 +28497,7 @@ async function connect(url, opts, deps) {
         id: row.id,
         ...billing,
         ...checkup ? { checkup } : {},
-        next: `The first charge failed (${row.billing_error}): the box was removed and nothing is billed. Update the payment method at ${billingUrl}, then re-run`
+        next: `The first charge failed (${row.billing_error}): the box is being removed and nothing is billed. Update the payment method${billingUrl ? ` at ${billingUrl}` : ""}, then re-run`
       };
     }
     const result = connectStatus(row, provider, fresh);
@@ -28380,9 +28525,15 @@ async function connect(url, opts, deps) {
   }
 }
 async function openConnection(url, opts) {
+  const config = checkUrlParams(url, opts.agent);
   const conn = resolveAdminConnection({ conn: url });
+  if (config) {
+    const { connectionString, ...explicit } = conn.clientConfig;
+    conn.clientConfig = { ...config, ...explicit };
+  }
   const fallback = !opts.agent && !!conn.sslFallbackEnabled;
   const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  await client.query("set search_path = pg_catalog, pg_temp");
   return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole(client) {
@@ -28483,7 +28634,7 @@ async function prepareDatabase(url, provider, opts = {}) {
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
         if (!process.env.PGAI_MON_PASSWORD?.trim())
-          return { next: `${exists}. ${setPassword}` };
+          return { next: `${exists}. ${setPassword}`, resettable: true };
         let accepted;
         try {
           accepted = await logsIn(loginUrlFor(url, me.db, password));
@@ -28596,6 +28747,7 @@ async function clickhouseOrgFor(host, keyId, keySecret) {
 function platformDeps(p) {
   const rpc = (fn, body = {}) => callRpc({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl, fn, body, operation: fn.replace(/_/g, " "), debug: p.debug, orgScope: p.orgScope });
   return {
+    verifyTls: verifyCollectorTls,
     list: () => rpc("cloud_monitoring_list"),
     create: (body) => rpc("cloud_monitoring_connect", body),
     disconnect: (id) => rpc("cloud_monitoring_disconnect", { instance_id: id }),
@@ -35294,7 +35446,7 @@ async function handleToolCall(req, rootOpts, extra) {
         return scope.error;
       const url = String(args.database_url ?? "");
       const u = parseUrl(url);
-      if (!u || !/^postgres(ql)?:$/.test(u.protocol) || !(u.password || u.searchParams.get("password"))) {
+      if (!u || !/^postgres(ql)?:$/.test(u.protocol)) {
         throw new Error("database_url must be postgresql://user:password@host:5432/dbname, with the password in it");
       }
       const result = await connect(url, {
@@ -36827,7 +36979,7 @@ function detectCloudProvider2(url) {
     return "supabase";
   return "self-managed";
 }
-function databaseName2(url) {
+function databaseName3(url) {
   const u = new URL(url);
   const port = u.port && u.port !== "5432" ? `:${u.port}` : "";
   let db = decodeURIComponent(u.pathname.replace(/^\//, ""));
@@ -36868,15 +37020,33 @@ function clusterOf2(url) {
   return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
 }
 var errorText2 = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText2).join("; ") : err instanceof Error ? err.message : String(err);
-var urlPassword2 = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
+var urlPassword2 = (u) => {
+  for (const key of [...u.searchParams.keys()])
+    if (key !== "password")
+      u.searchParams.delete(key);
+  return parse(u.toString()).password || "";
+};
 var URL_PARAMS_KEPT2 = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS2 = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
 function checkUrlParams2(url, agent) {
-  const keys = [...new Set(new URL(url).searchParams.keys())];
+  const u = new URL(url);
+  const keys = [...new Set(u.searchParams.keys())];
   if (agent) {
+    for (const key of ["password", "user", "host", "port", "dbname"]) {
+      if (u.searchParams.getAll(key).length > 1)
+        throw new Error(`database_url query parameter ${key} must appear only once`);
+    }
+    if (u.password && u.searchParams.has("password"))
+      throw new Error("database_url must give the password only once, in the authority or in ?password=");
     const refused = keys.filter((k) => k !== "password" && !URL_PARAMS_KEPT2.includes(k));
     if (refused.length)
       throw new Error(`database_url may carry only these query parameters: ${URL_PARAMS_KEPT2.join(", ")} (got: ${refused.join(", ")})`);
+    u.searchParams.delete("sslmode");
+    u.searchParams.delete("channel_binding");
+    const config = parseIntoClientConfig(u.toString());
+    if (!/^postgres(ql)?:$/.test(u.protocol) || typeof config.password !== "string" || !config.password)
+      throw new Error("database_url must be postgresql://user:password@host:5432/dbname, with the password in it");
+    return { ...config, password: config.password };
   }
   const moved = keys.filter((k) => k === "host" || k === "port");
   if (moved.length)
@@ -36909,7 +37079,7 @@ function roleUrlFor2(url, db, password, kept) {
   u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
-var monitoringUrlFor2 = (url, db, password) => roleUrlFor2(url, db, password, URL_PARAMS_KEPT2);
+var monitoringUrlFor2 = (url, db, password) => roleUrlFor2(url, db, password, URL_PARAMS_KEPT2.filter((p) => p !== "channel_binding"));
 var loginUrlFor2 = (url, db, password) => roleUrlFor2(url, db, password, [...URL_PARAMS_KEPT2, ...URL_PARAMS_TLS2]);
 function caNote2(url) {
   const q = new URL(url).searchParams;
@@ -36994,7 +37164,19 @@ async function connect2(url, opts, deps) {
   if (!PROVIDERS2.includes(provider))
     throw new Error(`--provider must be one of: ${PROVIDERS2.join(", ")}`);
   checkUrlParams2(url, opts.agent);
-  const name = databaseName2(url);
+  const name = databaseName3(url);
+  try {
+    const collector = await collectorConnection(url, deps.verifyTls);
+    const required = splitChannelBinding(url).value === "require";
+    url = collector.url;
+    if (collector.note)
+      progress("preparing", `${required ? "Warning" : "Note"}: ${collector.note}`);
+    if (required && caNote2(url))
+      progress("preparing", `Note: ${caNote2(url)}`);
+  } catch (err) {
+    return { status: "action_required", provider, name, next: err instanceof Error ? err.message : String(err) };
+  }
+  const cluster = clusterOf2(url);
   const key = parseClickhouseKey2(opts.clickhouseKey, provider === "clickhouse" && !opts.agent ? process.env : {});
   if (key && provider !== "clickhouse")
     throw new Error("--clickhouse-key applies to ClickHouse Managed Postgres only");
@@ -37007,8 +37189,12 @@ async function connect2(url, opts, deps) {
   if (opts.selfHosted && deps.localStackRunning()) {
     return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
+  const findDatabase = (list) => {
+    const live = list.filter((d) => !disconnecting2(d.status));
+    return live.find((d) => d.cluster === cluster && d.database != null && decodeURIComponent(d.database) === name.split("/").slice(1).join("/")) ?? live.find((d) => (d.cluster == null || d.database == null) && d.name === name);
+  };
   const rows = opts.selfHosted ? [] : await deps.list();
-  let row = rows.find((d) => d.name === name && !disconnecting2(d.status));
+  let row = findDatabase(rows);
   const fresh = !row;
   let note = "";
   let checkup;
@@ -37050,9 +37236,10 @@ async function connect2(url, opts, deps) {
         await deps.unprepare(url).catch(() => false);
     };
     let lockId;
-    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
-    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting2(d.status) && (unread(d) || serverOf2(d.name) === serverOf2(name)));
-    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf2(d.name) === serverOf2(name)) || undefined;
+    const unread = (d) => !d.cluster && !/^[A-Za-z0-9._\[\]:-]{1,253}(?::[0-9]+)?(?:\/[A-Za-z0-9._-]*)?$/.test(d.name);
+    const onServer = (d) => d.cluster ? d.cluster === cluster : !unread(d) && serverOf2(d.name) === serverOf2(name);
+    const othersOnServer = (list) => list.filter((d) => !disconnecting2(d.status) && (unread(d) || onServer(d)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && onServer(d)) || undefined;
     const cutOff = (others) => {
       const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
       const maybe = others.filter(unread).map((d) => d.name).join(", ");
@@ -37073,8 +37260,13 @@ async function connect2(url, opts, deps) {
     const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
     if (!opts.selfHosted) {
       const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
-      if ("next" in probe)
-        return { status: "action_required", provider, name, ...probe };
+      if ("next" in probe) {
+        const { resettable, ...refusal } = probe;
+        if (resettable && !opts.resetPassword && !opts.agent && await deps.confirm("A monitoring role from an earlier connection exists, and its password isn't stored. Reset it now? Anything else using this role will need the new password. [y/N] ")) {
+          return connect2(url, { ...opts, resetPassword: true }, deps);
+        }
+        return { status: "action_required", provider, name, ...refusal };
+      }
       const b = await billingFor2(await deps.quote(opts.coupon, clusterOf2(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
       if (b.stop)
         return { status: "action_required", provider, name, ...b.stop };
@@ -37083,10 +37275,10 @@ async function connect2(url, opts, deps) {
     if (opts.resetPassword) {
       let lock;
       try {
-        lock = await deps.resetLock(serverOf2(name));
+        lock = await deps.resetLock(cluster);
       } catch (err) {
         if (err instanceof HttpStatusError && err.status === 409) {
-          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf2(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${cluster} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
         }
         if (err instanceof HttpStatusError && err.status === 404) {
           return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
@@ -37103,7 +37295,7 @@ async function connect2(url, opts, deps) {
     try {
       if (lockId) {
         const now = await deps.list();
-        const same = now.find((d) => d.name === name && !disconnecting2(d.status));
+        const same = findDatabase(now);
         if (same)
           return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
         const others = othersOnServer(now);
@@ -37112,8 +37304,10 @@ async function connect2(url, opts, deps) {
       }
       progress("preparing", `Preparing ${maskConnectionString(url)}`);
       prepared = await deps.prepare(url, provider, prepOpts);
-      if ("next" in prepared)
-        return { status: "action_required", provider, name, ...billing, ...prepared };
+      if ("next" in prepared) {
+        const { resettable, ...refusal } = prepared;
+        return { status: "action_required", provider, name, ...billing, ...refusal };
+      }
       if (!("monitoringUrl" in prepared))
         throw new Error("prepare returned no monitoring URL");
       if (prepared.note)
@@ -37174,8 +37368,9 @@ async function connect2(url, opts, deps) {
   }
   let shown;
   for (const deadline = deps.now() + opts.waitMs;; ) {
-    if (undoRole && row.billing_error && disconnecting2(row.status)) {
-      await undoRole();
+    if (row.billing_error && disconnecting2(row.status)) {
+      if (undoRole)
+        await undoRole();
       return {
         status: "action_required",
         provider,
@@ -37183,7 +37378,7 @@ async function connect2(url, opts, deps) {
         id: row.id,
         ...billing,
         ...checkup ? { checkup } : {},
-        next: `The first charge failed (${row.billing_error}): the box was removed and nothing is billed. Update the payment method at ${billingUrl}, then re-run`
+        next: `The first charge failed (${row.billing_error}): the box is being removed and nothing is billed. Update the payment method${billingUrl ? ` at ${billingUrl}` : ""}, then re-run`
       };
     }
     const result = connectStatus2(row, provider, fresh);
@@ -37211,9 +37406,15 @@ async function connect2(url, opts, deps) {
   }
 }
 async function openConnection2(url, opts) {
+  const config = checkUrlParams2(url, opts.agent);
   const conn = resolveAdminConnection({ conn: url });
+  if (config) {
+    const { connectionString, ...explicit } = conn.clientConfig;
+    conn.clientConfig = { ...config, ...explicit };
+  }
   const fallback = !opts.agent && !!conn.sslFallbackEnabled;
   const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  await client.query("set search_path = pg_catalog, pg_temp");
   return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole2(client) {
@@ -37314,7 +37515,7 @@ async function prepareDatabase2(url, provider, opts = {}) {
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
         if (!process.env.PGAI_MON_PASSWORD?.trim())
-          return { next: `${exists}. ${setPassword}` };
+          return { next: `${exists}. ${setPassword}`, resettable: true };
         let accepted;
         try {
           accepted = await logsIn(loginUrlFor2(url, me.db, password));
@@ -37443,6 +37644,7 @@ function disconnectBilling(reply) {
 function platformDeps2(p) {
   const rpc = (fn, body = {}) => callRpc({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl, fn, body, operation: fn.replace(/_/g, " "), debug: p.debug, orgScope: p.orgScope });
   return {
+    verifyTls: verifyCollectorTls,
     list: () => rpc("cloud_monitoring_list"),
     create: (body) => rpc("cloud_monitoring_connect", body),
     disconnect: (id) => rpc("cloud_monitoring_disconnect", { instance_id: id }),
@@ -41684,12 +41886,13 @@ async function generateD0042(client, nodeName) {
   let pgssError = null;
   const pgssSampleQueries = [];
   try {
-    const extCheck = await client.query("select 1 from pg_extension where extname = 'pg_stat_statements'");
+    const extCheck = await client.query("select n.nspname as schema from pg_catalog.pg_extension e join pg_catalog.pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'");
     if (extCheck.rows.length > 0) {
       pgssAvailable = true;
+      const pgssView = quoteIdent4(extCheck.rows[0].schema, "pg_stat_statements");
       const statsResult = await client.query(`
         select count(*) as cnt, coalesce(sum(calls), 0) as total_calls
-        from pg_stat_statements
+        from ${pgssView}
       `);
       pgssMetricsCount = parseInt(statsResult.rows[0]?.cnt || "0", 10);
       pgssTotalCalls = parseInt(statsResult.rows[0]?.total_calls || "0", 10);
@@ -41699,7 +41902,7 @@ async function generateD0042(client, nodeName) {
           coalesce(usename, 'unknown') as "user",
           coalesce(datname, 'unknown') as database,
           calls
-        from pg_stat_statements s
+        from ${pgssView} s
         left join pg_database d on s.dbid = d.oid
         left join pg_user u on s.userid = u.usesysid
         order by calls desc
@@ -41727,16 +41930,17 @@ async function generateD0042(client, nodeName) {
   let kcacheError = null;
   const kcacheSampleQueries = [];
   try {
-    const extCheck = await client.query("select 1 from pg_extension where extname = 'pg_stat_kcache'");
+    const extCheck = await client.query("select n.nspname as schema from pg_catalog.pg_extension e join pg_catalog.pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_kcache'");
     if (extCheck.rows.length > 0) {
       kcacheAvailable = true;
+      const kcacheView = quoteIdent4(extCheck.rows[0].schema, "pg_stat_kcache");
       const statsResult = await client.query(`
         select
           count(*) as cnt,
           coalesce(sum(exec_user_time + exec_system_time), 0) as total_exec_time,
           coalesce(sum(exec_user_time), 0) as total_user_time,
           coalesce(sum(exec_system_time), 0) as total_system_time
-        from pg_stat_kcache
+        from ${kcacheView}
       `);
       kcacheMetricsCount = parseInt(statsResult.rows[0]?.cnt || "0", 10);
       kcacheTotalExecTime = parseFloat(statsResult.rows[0]?.total_exec_time || "0");
@@ -41747,7 +41951,7 @@ async function generateD0042(client, nodeName) {
           queryid::text as queryid,
           coalesce(usename, 'unknown') as "user",
           (exec_user_time + exec_system_time) as exec_total_time
-        from pg_stat_kcache k
+        from ${kcacheView} k
         left join pg_user u on k.userid = u.usesysid
         order by (exec_user_time + exec_system_time) desc
         limit 5
@@ -43855,14 +44059,14 @@ function writeInstancesFile(file, instances) {
     fs10.closeSync(fd);
   }
 }
-function extractSslmode(connStr) {
+function extractSslmode2(connStr) {
   try {
     return (new URL(connStr).searchParams.get("sslmode") || "").toLowerCase();
   } catch {
     return "";
   }
 }
-function sslOptionFromSslmode(sslmode) {
+function sslOptionFromSslmode2(sslmode) {
   switch (sslmode) {
     case "disable":
       return false;
@@ -43886,7 +44090,7 @@ function isLaxSslmode(sslmode) {
   return LAX_SSLMODES2.has(sslmode);
 }
 function warnIfLaxSslmode(connStr) {
-  const sslmode = extractSslmode(connStr);
+  const sslmode = extractSslmode2(connStr);
   if (!isLaxSslmode(sslmode))
     return;
   const shown = sslmode || "(unset)";
@@ -43908,23 +44112,23 @@ function warnIfTransactionPoolerPort(connStr) {
     return;
   console.error(`⚠ port ${SUPABASE_POOLER_TRANSACTION_PORT2} is the pooler's TRANSACTION mode: ` + `pooled backends share prepared statements, so collection fails with ` + `42P05 (prepared statement already exists) and metrics stop silently. ` + `Use port ${SUPABASE_POOLER_SESSION_PORT2} on the same host for session mode.`);
 }
-function buildClientConfig(connStr, extra = {}) {
-  const sslmode = extractSslmode(connStr);
+function buildClientConfig2(connStr, extra = {}) {
+  const sslmode = extractSslmode2(connStr);
   const channelBinding = splitChannelBinding2(connStr);
   const enableChannelBinding = requireChannelBinding2(channelBinding.value, sslmode === "disable");
-  const parsed = parse(withoutSslmode(channelBinding.uri));
+  const parsed = parse(withoutSslmode2(channelBinding.uri));
   return {
     host: parsed.host || undefined,
     port: parsed.port ? Number(parsed.port) : undefined,
     user: parsed.user,
     password: parsed.password,
-    database: databaseName3(withoutSslmode(channelBinding.uri), parsed.database),
-    ssl: sslOptionFromSslmode(sslmode),
+    database: databaseName4(withoutSslmode2(channelBinding.uri), parsed.database),
+    ssl: sslOptionFromSslmode2(sslmode),
     ...enableChannelBinding ? { enableChannelBinding: true } : {},
     ...extra
   };
 }
-function databaseName3(connStr, parsed) {
+function databaseName4(connStr, parsed) {
   if (!parsed)
     return;
   try {
@@ -43934,7 +44138,7 @@ function databaseName3(connStr, parsed) {
   } catch {}
   return parsed;
 }
-function withoutSslmode(connStr) {
+function withoutSslmode2(connStr) {
   try {
     const u = new URL(connStr);
     u.searchParams.delete("sslmode");
@@ -43956,6 +44160,47 @@ function splitChannelBinding2(uri) {
   const params = uri.slice(start + 1, end).split("&").filter((param) => !new URLSearchParams(param).has("channel_binding"));
   return { uri: uri.slice(0, start) + (params.length ? `?${params.join("&")}` : "") + uri.slice(end), value };
 }
+async function verifyCollectorTls2(url) {
+  const u = new URL(url);
+  const ca = u.searchParams.get("sslrootcert");
+  for (const key of ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"])
+    u.searchParams.delete(key);
+  const client = new Client2({
+    ...buildClientConfig2(splitChannelBinding2(u.toString()).uri, { connectionTimeoutMillis: 1e4 }),
+    ssl: { rejectUnauthorized: true, servername: u.hostname, ...ca ? { ca: fs10.readFileSync(ca, "utf8") } : {} }
+  });
+  try {
+    await client.connect();
+  } catch (err) {
+    if (!client.connection.stream.authorized)
+      throw err;
+  } finally {
+    await client.end().catch(() => {});
+  }
+}
+async function collectorConnection2(url, verifyTls = verifyCollectorTls2) {
+  const binding = splitChannelBinding2(url);
+  const sslmode = extractSslmode2(url);
+  if (binding.value === "require") {
+    if (sslmode === "disable" || sslmode === "allow") {
+      throw new Error(`channel_binding=require needs TLS, but sslmode=${sslmode} is set`);
+    }
+    let collectorUrl = binding.uri;
+    if (sslmode !== "verify-full") {
+      const u = new URL(collectorUrl);
+      u.searchParams.set("sslmode", "verify-full");
+      collectorUrl = u.toString();
+      try {
+        await verifyTls(collectorUrl);
+      } catch (err) {
+        const why = err instanceof Error && err.message ? ` (${err.message})` : "";
+        throw new Error(`Could not verify the TLS certificate for channel_binding=require${why}. Provide sslrootcert=<CA file> with sslmode=verify-full, or explicitly accept the downgrade by removing channel_binding=require from the URL`);
+      }
+    }
+    return { url: collectorUrl, note: "the collector can't do channel binding; it connects with TLS and full certificate verification" + (sslmode !== "verify-full" ? "; upgraded to sslmode=verify-full" : "") };
+  }
+  return { url: binding.uri, ...binding.value !== null ? { note: "removed channel_binding from the connection string; the collector does not support it (TLS is kept)" } : {} };
+}
 function requireChannelBinding2(value, sslDisabled) {
   if (value !== "require")
     return false;
@@ -46601,7 +46846,7 @@ async function runConnect(url, opts) {
   const json = jsonOutput(opts.json);
   const name = (() => {
     try {
-      return databaseName2(url);
+      return databaseName3(url);
     } catch {
       return "";
     }
@@ -46721,7 +46966,7 @@ withOrgOptions(program2.command("disconnect <name>")).description("stop monitori
     const [row] = (await cloudDatabases(opts, name)).filter((d) => !disconnecting2(d.status));
     if (!row)
       throw new Error(`No database named ${name}. See: pgai databases`);
-    if (!opts.yes && !(process.stdin.isTTY && /^y/i.test(await question(`Disconnect ${row.name} and delete its monitoring box? (y/N): `)))) {
+    if (!opts.yes && !(interactive(opts.json) && /^y/i.test(await question(`Disconnect ${row.name} and delete its monitoring box? (y/N): `)))) {
       return emitConnect({ status: "action_required", provider: row.provider, name: row.name, id: row.id, next: `pgai disconnect ${row.name} --yes` }, opts.json);
     }
     const billing = disconnectBilling(await cloudApi(opts.debug).disconnect(row.id));
@@ -46889,7 +47134,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
         try {
           warnIfLaxSslmode(connStr);
           warnIfTransactionPoolerPort(connStr);
-          testClient = new Client(buildClientConfig(connStr, { connectionTimeoutMillis: 1e4 }));
+          testClient = new Client(buildClientConfig2(connStr, { connectionTimeoutMillis: 1e4 }));
           await testClient.connect();
           const result = await testClient.query("select version();");
           console.log("\u2713 Connection successful");
@@ -46933,7 +47178,7 @@ You can provide either:`);
             try {
               warnIfLaxSslmode(connStr);
               warnIfTransactionPoolerPort(connStr);
-              testClient = new Client(buildClientConfig(connStr, { connectionTimeoutMillis: 1e4 }));
+              testClient = new Client(buildClientConfig2(connStr, { connectionTimeoutMillis: 1e4 }));
               await testClient.connect();
               const result = await testClient.query("select version();");
               console.log("\u2713 Connection successful");
@@ -47776,22 +48021,30 @@ async function syncVmalert(projectDir, apply, addOnly = false) {
 }
 var looksLikeConnStr = (value) => /^postgres(ql)?:\/\//i.test(value);
 var isPlainTargetName = (value) => /^[A-Za-z0-9._=-]+$/.test(value) && !/(password|pwd)\s*=/i.test(value);
-async function addTarget(file, projectDir, connStr, name, env, { apply = true } = {}) {
+async function addTarget(file, projectDir, connStr, name, env, { apply = true, verifyTls } = {}) {
   if (!connStr) {
     console.error("Connection string required: postgresql://user:pass@host:port/db");
     process.exitCode = 1;
     return false;
   }
   const channelBinding = splitChannelBinding2(connStr);
-  connStr = channelBinding.uri;
-  const defaultName = defaultTargetName(connStr);
+  const defaultName = defaultTargetName(channelBinding.uri);
   if ("error" in defaultName) {
     console.error(defaultName.error);
     process.exitCode = 1;
     return false;
   }
-  if (channelBinding.value !== null) {
-    console.error("Note: removed channel_binding from the connection string; the collector does not support it (TLS is kept)");
+  try {
+    const collector = await collectorConnection2(connStr, verifyTls);
+    connStr = collector.url;
+    if (collector.note)
+      console.error(`${channelBinding.value === "require" ? "Warning" : "Note"}: ${collector.note}`);
+    if (channelBinding.value === "require" && caNote2(connStr))
+      console.error(`Note: ${caNote2(connStr)}`);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+    return false;
   }
   const instanceName = name && name.trim() ? name.trim() : defaultName.name;
   if (detectProvider(connStr) !== "clickhouse" && extractProjectRefFromUrl(connStr) && supabaseHostMetricsOn(projectDir, env) && !SUPABASE_TARGET_NAME_RE.test(instanceName)) {
@@ -47991,7 +48244,7 @@ targets.command("test <name>").description("test monitoring target database conn
   console.log(`Testing connection to monitoring target '${name}'...`);
   warnIfLaxSslmode(instance.conn_str);
   warnIfTransactionPoolerPort(instance.conn_str);
-  const client = new Client(buildClientConfig(instance.conn_str, { connectionTimeoutMillis: 1e4 }));
+  const client = new Client(buildClientConfig2(instance.conn_str, { connectionTimeoutMillis: 1e4 }));
   try {
     try {
       await client.connect();

package/dist/sql/02.extensions.sql

@@ -3,6 +3,6 @@
 -- Enable pg_stat_statements for query performance monitoring
 -- Note: Uses IF NOT EXISTS because extension may already be installed.
 -- We do NOT drop this extension in unprepare-db since it may have been pre-existing.
-create extension if not exists pg_stat_statements;
+create extension if not exists pg_stat_statements with schema public;
 
 

package/dist/sql/04.optional_rds.sql

@@ -1,6 +1,7 @@
 -- Optional permissions for RDS Postgres / Aurora (best effort)
 
-create extension if not exists rds_tools;
+create schema if not exists rds_tools;
+create extension if not exists rds_tools with schema rds_tools;
 grant execute on function rds_tools.pg_ls_multixactdir() to {{ROLE_IDENT}};
 
 

package/dist/sql/sql/02.extensions.sql

@@ -3,6 +3,6 @@
 -- Enable pg_stat_statements for query performance monitoring
 -- Note: Uses IF NOT EXISTS because extension may already be installed.
 -- We do NOT drop this extension in unprepare-db since it may have been pre-existing.
-create extension if not exists pg_stat_statements;
+create extension if not exists pg_stat_statements with schema public;
 
 

package/dist/sql/sql/04.optional_rds.sql

@@ -1,6 +1,7 @@
 -- Optional permissions for RDS Postgres / Aurora (best effort)
 
-create extension if not exists rds_tools;
+create schema if not exists rds_tools;
+create extension if not exists rds_tools with schema rds_tools;
 grant execute on function rds_tools.pg_ls_multixactdir() to {{ROLE_IDENT}};
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresai",
-  "version": "0.17.0-dev.8",
+  "version": "0.17.0-dev.9",
   "description": "postgres_ai CLI",
   "license": "Apache-2.0",
   "private": false,

package/sql/02.extensions.sql

@@ -3,6 +3,6 @@
 -- Enable pg_stat_statements for query performance monitoring
 -- Note: Uses IF NOT EXISTS because extension may already be installed.
 -- We do NOT drop this extension in unprepare-db since it may have been pre-existing.
-create extension if not exists pg_stat_statements;
+create extension if not exists pg_stat_statements with schema public;
 
 

package/sql/04.optional_rds.sql

@@ -1,6 +1,7 @@
 -- Optional permissions for RDS Postgres / Aurora (best effort)
 
-create extension if not exists rds_tools;
+create schema if not exists rds_tools;
+create extension if not exists rds_tools with schema rds_tools;
 grant execute on function rds_tools.pg_ls_multixactdir() to {{ROLE_IDENT}};