@carllee1983/dbcli 1.25.0 → 1.28.0

package/dist/cli.mjs

@@ -25565,7 +25565,7 @@ class AuditLockManager {
 var LOCK_RETRY_BUDGET_MS = 200, LOCK_BACKOFF_START_MS = 5, LOCK_BACKOFF_MAX_MS = 50, STALE_LOCK_MULTIPLIER = 10;
 var init_lock = () => {};
 
-// src/core/audit/rotation.ts
+// src/utils/jsonl-rotation.ts
 import { rename } from "fs/promises";
 function shouldRotate(stats, thresholds, nextLineByteLength) {
   const bytesAfter = stats.currentSizeBytes + nextLineByteLength;
@@ -25577,7 +25577,12 @@ async function rotate(currentPath, previousPath) {
     await rename(currentPath, previousPath);
   } catch {}
 }
-var init_rotation = () => {};
+var init_jsonl_rotation = () => {};
+
+// src/core/audit/rotation.ts
+var init_rotation = __esm(() => {
+  init_jsonl_rotation();
+});
 
 // src/core/audit/logger.ts
 import { appendFile, mkdir as mkdir3, readFile, stat } from "fs/promises";
@@ -81217,7 +81222,7 @@ var {
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "1.25.0",
+  version: "1.28.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -81226,6 +81231,13 @@ var package_default = {
   bin: {
     dbcli: "./dist/cli.mjs"
   },
+  exports: {
+    ".": "./dist/cli.mjs",
+    "./core": {
+      types: "./dist/core.d.ts",
+      import: "./dist/core.mjs"
+    }
+  },
   license: "MIT",
   author: "Carl Lee",
   repository: {
@@ -81296,9 +81308,11 @@ var package_default = {
     "@inquirer/prompts": "^8.4.3",
     "@testing-library/react": "^16.3.2",
     "@types/bun": "latest",
+    "@types/pg": "^8.20.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     autoprefixer: "^10.5.0",
+    "dts-bundle-generator": "^9.5.1",
     eslint: "^10.4.0",
     "happy-dom": "^20.9.0",
     postcss: "^8.5.14",
@@ -94602,14 +94616,1214 @@ var useCommand = new Command("use").description("Switch or display the default d
   }
 });
 
-// src/cli.ts
+// src/commands/proxy.ts
 init_config();
+init_validation();
 import { join as join32 } from "path";
+
+// src/proxy/relay.ts
+class TcpRelay {
+  clientBytes = 0;
+  serverBytes = 0;
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  fromClient(bytes) {
+    this.opts.writeToUpstream(bytes);
+    this.clientBytes += bytes.length;
+    this.feed("client_to_server", bytes);
+  }
+  fromUpstream(bytes) {
+    this.opts.writeToClient(bytes);
+    this.serverBytes += bytes.length;
+    this.feed("server_to_client", bytes);
+  }
+  feed(direction, bytes) {
+    try {
+      this.opts.analyzer.onData(direction, bytes);
+    } catch (err) {
+      this.opts.onSignal({
+        kind: "parse_error",
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+}
+
+// src/proxy/events.ts
+init_jsonl_rotation();
+import { appendFile as appendFile2, mkdir as mkdir10, readFile as readFile6, stat as stat8 } from "fs/promises";
+import { dirname as dirname11 } from "path";
+
+// src/proxy/sql-metadata.ts
+var KNOWN_KEYWORDS = [
+  "SELECT",
+  "INSERT",
+  "UPDATE",
+  "DELETE",
+  "CREATE",
+  "ALTER",
+  "DROP",
+  "TRUNCATE",
+  "BEGIN",
+  "COMMIT",
+  "ROLLBACK",
+  "SET",
+  "SHOW",
+  "USE"
+];
+var KNOWN = new Set(KNOWN_KEYWORDS);
+function detectStatement(sql) {
+  const m = sql.trim().match(/^([a-zA-Z]+)/);
+  if (!m || !m[1])
+    return "OTHER";
+  const kw = m[1].toUpperCase();
+  return KNOWN.has(kw) ? kw : "OTHER";
+}
+var TABLE_RE = /\b(?:FROM|JOIN|INTO|UPDATE)\s+["'`]?([A-Za-z_]\w*)["'`]?(?:\.["'`]?([A-Za-z_]\w*)["'`]?)?/gi;
+function extractTables(sql) {
+  const seen = new Set;
+  for (const m of sql.matchAll(TABLE_RE)) {
+    const name2 = m[2] ?? m[1];
+    if (name2)
+      seen.add(name2);
+  }
+  return [...seen];
+}
+function redactLiterals(sql) {
+  const noStrings = sql.replace(/'(?:[^']|'')*'/g, "?");
+  return noStrings.replace(/\b\d+(?:\.\d+)?\b/g, "?");
+}
+
+// src/proxy/events.ts
+var PROXY_EVENT_VERSION = 1;
+function hasSql(e) {
+  return e.type === "query_observed" || e.type === "query_completed" || e.type === "query_errored";
+}
+function applyRedaction(event, mode) {
+  if (mode === "none" || !hasSql(event))
+    return event;
+  return { ...event, sql: redactLiterals(event.sql) };
+}
+var DEFAULT_ROTATION = {
+  maxBytes: 50 * 1024 * 1024,
+  maxEntries: 200000
+};
+
+class EventWriter {
+  path;
+  previousPath;
+  redact;
+  maxBytes;
+  maxEntries;
+  dirEnsured = false;
+  initialized = false;
+  currentSizeBytes = 0;
+  currentEntryCount = 0;
+  writeChain = Promise.resolve();
+  constructor(opts) {
+    this.path = opts.path;
+    this.previousPath = `${opts.path}.1`;
+    this.redact = opts.redact;
+    this.maxBytes = opts.rotation?.maxBytes ?? DEFAULT_ROTATION.maxBytes;
+    this.maxEntries = opts.rotation?.maxEntries ?? DEFAULT_ROTATION.maxEntries;
+  }
+  write(event) {
+    const op = this.writeChain.then(() => this.writeInternal(event));
+    this.writeChain = op.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return op;
+  }
+  async writeInternal(event) {
+    if (!this.dirEnsured) {
+      await mkdir10(dirname11(this.path), { recursive: true });
+      this.dirEnsured = true;
+    }
+    if (!this.initialized) {
+      await this.syncCountersFromDisk();
+      this.initialized = true;
+    }
+    const redacted = applyRedaction(event, this.redact);
+    const line = JSON.stringify(redacted) + `
+`;
+    const lineBytes = Buffer.byteLength(line, "utf8");
+    if (shouldRotate({ currentSizeBytes: this.currentSizeBytes, currentEntryCount: this.currentEntryCount }, { maxBytes: this.maxBytes, maxEntries: this.maxEntries }, lineBytes)) {
+      await rotate(this.path, this.previousPath);
+      this.currentSizeBytes = 0;
+      this.currentEntryCount = 0;
+    }
+    await appendFile2(this.path, line, { encoding: "utf8" });
+    this.currentSizeBytes += lineBytes;
+    this.currentEntryCount += 1;
+  }
+  async syncCountersFromDisk() {
+    try {
+      const s = await stat8(this.path);
+      this.currentSizeBytes = s.size;
+      const raw = await readFile6(this.path, "utf8");
+      this.currentEntryCount = raw.split(`
+`).filter(Boolean).length;
+    } catch {
+      this.currentSizeBytes = 0;
+      this.currentEntryCount = 0;
+    }
+  }
+}
+
+// src/proxy/session.ts
+class ProxySession {
+  o;
+  active = null;
+  queryCounter = 0;
+  startedAt = 0;
+  clientBytesAtBoundary = 0;
+  pending = Promise.resolve();
+  constructor(opts) {
+    this.o = opts;
+  }
+  enqueue(event) {
+    this.pending = this.pending.then(() => this.o.writeEvent(event)).catch((err) => {
+      this.o.warn(`event write failed: ${err instanceof Error ? err.message : String(err)}`);
+    });
+  }
+  async start() {
+    this.startedAt = this.o.now();
+    this.enqueue({
+      version: PROXY_EVENT_VERSION,
+      type: "session_started",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: this.o.sessionId,
+      client: this.o.client,
+      target: this.o.target
+    });
+    await this.flush();
+  }
+  onSignal(signal) {
+    switch (signal.kind) {
+      case "query":
+        this.beginQuery(signal.sql, signal.tags ?? []);
+        break;
+      case "query_end":
+        this.completeQuery(signal.rowCount ?? null);
+        break;
+      case "error":
+        this.errorQuery(signal.code, signal.message);
+        break;
+      case "tag":
+        if (this.active && !this.active.tags.includes(signal.tag)) {
+          this.active.tags.push(signal.tag);
+        }
+        break;
+      case "parse_error":
+        this.enqueue({
+          version: PROXY_EVENT_VERSION,
+          type: "parse_error",
+          timestamp: new Date().toISOString(),
+          engine: this.o.engine,
+          sessionId: this.o.sessionId,
+          client: this.o.client,
+          target: this.o.target,
+          message: signal.message,
+          tags: []
+        });
+        break;
+    }
+  }
+  beginQuery(sql, tags) {
+    const bytes = this.o.getBytes();
+    this.queryCounter += 1;
+    this.active = {
+      queryId: `qry_${this.o.sessionId}_${this.queryCounter}`,
+      sql,
+      startedAt: this.o.now(),
+      clientBytesAtStart: this.clientBytesAtBoundary,
+      serverBytesAtStart: bytes.serverBytes,
+      tags: [...tags]
+    };
+    this.enqueue({
+      version: PROXY_EVENT_VERSION,
+      type: "query_observed",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: this.o.sessionId,
+      queryId: this.active.queryId,
+      client: this.o.client,
+      target: this.o.target,
+      sql,
+      statement: detectStatement(sql),
+      tables: extractTables(sql),
+      tags: [...this.active.tags]
+    });
+  }
+  completeQuery(rowCount) {
+    const q3 = this.active;
+    if (!q3)
+      return;
+    const bytes = this.o.getBytes();
+    const durationMs = this.o.now() - q3.startedAt;
+    const requestBytes = bytes.clientBytes - q3.clientBytesAtStart;
+    const responseBytes = bytes.serverBytes - q3.serverBytesAtStart;
+    const slow = durationMs >= this.o.slowMs;
+    this.enqueue({
+      version: PROXY_EVENT_VERSION,
+      type: "query_completed",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: this.o.sessionId,
+      queryId: q3.queryId,
+      client: this.o.client,
+      target: this.o.target,
+      sql: q3.sql,
+      statement: detectStatement(q3.sql),
+      tables: extractTables(q3.sql),
+      durationMs,
+      requestBytes,
+      responseBytes,
+      rowCount,
+      slow,
+      error: null,
+      tags: [...q3.tags]
+    });
+    if (slow) {
+      this.o.warn(`slow query (${durationMs}ms): ${q3.sql.slice(0, 80)}`);
+    }
+    this.clientBytesAtBoundary = bytes.clientBytes;
+    this.active = null;
+  }
+  errorQuery(code, message) {
+    const q3 = this.active;
+    const bytes = this.o.getBytes();
+    const startedAt = q3?.startedAt ?? this.o.now();
+    this.enqueue({
+      version: PROXY_EVENT_VERSION,
+      type: "query_errored",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: this.o.sessionId,
+      queryId: q3?.queryId ?? `qry_${this.o.sessionId}_err_${++this.queryCounter}`,
+      client: this.o.client,
+      target: this.o.target,
+      sql: q3?.sql ?? "",
+      statement: detectStatement(q3?.sql ?? ""),
+      tables: extractTables(q3?.sql ?? ""),
+      durationMs: this.o.now() - startedAt,
+      requestBytes: q3 ? bytes.clientBytes - q3.clientBytesAtStart : 0,
+      responseBytes: q3 ? bytes.serverBytes - q3.serverBytesAtStart : 0,
+      rowCount: null,
+      error: { code, message },
+      tags: q3 ? [...q3.tags] : []
+    });
+    this.clientBytesAtBoundary = bytes.clientBytes;
+    this.active = null;
+  }
+  async end(reason) {
+    const bytes = this.o.getBytes();
+    this.enqueue({
+      version: PROXY_EVENT_VERSION,
+      type: "session_ended",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: this.o.sessionId,
+      client: this.o.client,
+      target: this.o.target,
+      durationMs: this.o.now() - this.startedAt,
+      requestBytes: bytes.clientBytes,
+      responseBytes: bytes.serverBytes,
+      reason
+    });
+    await this.flush();
+  }
+  async flush() {
+    await this.pending;
+  }
+}
+
+// src/proxy/analyzers/types.ts
+var UTF8 = new TextDecoder;
+
+class FrameBuffer {
+  buf = new Uint8Array(0);
+  get length() {
+    return this.buf.length;
+  }
+  push(chunk) {
+    if (this.buf.length === 0) {
+      this.buf = chunk.slice();
+      return;
+    }
+    const next = new Uint8Array(this.buf.length + chunk.length);
+    next.set(this.buf, 0);
+    next.set(chunk, this.buf.length);
+    this.buf = next;
+  }
+  peek(n) {
+    return this.buf.subarray(0, Math.min(n, this.buf.length));
+  }
+  byteAt(offset) {
+    return this.buf[offset];
+  }
+  consume(n) {
+    this.buf = this.buf.subarray(Math.min(n, this.buf.length));
+  }
+  readUInt24LE(offset) {
+    const b0 = this.buf[offset] ?? 0;
+    const b1 = this.buf[offset + 1] ?? 0;
+    const b2 = this.buf[offset + 2] ?? 0;
+    return b0 | b1 << 8 | b2 << 16;
+  }
+  readUInt16LE(offset) {
+    const b0 = this.buf[offset] ?? 0;
+    const b1 = this.buf[offset + 1] ?? 0;
+    return b0 | b1 << 8;
+  }
+  readUInt32BE(offset) {
+    const b0 = this.buf[offset] ?? 0;
+    const b1 = this.buf[offset + 1] ?? 0;
+    const b2 = this.buf[offset + 2] ?? 0;
+    const b3 = this.buf[offset + 3] ?? 0;
+    return (b0 << 24 >>> 0) + (b1 << 16) + (b2 << 8) + b3;
+  }
+  text(start, end) {
+    return UTF8.decode(this.buf.subarray(start, end));
+  }
+}
+
+// src/proxy/analyzers/mysql.ts
+var COM_QUERY = 3;
+var COM_STMT_PREPARE = 22;
+var COM_STMT_EXECUTE = 23;
+var HEADER = 4;
+function createMysqlAnalyzer(deps) {
+  const clientBuf = new FrameBuffer;
+  const serverBuf = new FrameBuffer;
+  let awaitingResponse = false;
+  function handleClientPacket(payloadStart, payloadLen) {
+    const seqId = clientBuf.byteAt(payloadStart - 1);
+    if (seqId !== 0)
+      return;
+    const cmd = clientBuf.byteAt(payloadStart);
+    if (cmd === undefined)
+      return;
+    if (cmd === COM_QUERY) {
+      const sql = clientBuf.text(payloadStart + 1, payloadStart + payloadLen);
+      deps.emit({ kind: "query", sql });
+      awaitingResponse = true;
+    } else if (cmd === COM_STMT_PREPARE) {
+      const sql = clientBuf.text(payloadStart + 1, payloadStart + payloadLen);
+      deps.emit({ kind: "query", sql, tags: ["prepared_statement"] });
+      awaitingResponse = true;
+    } else if (cmd === COM_STMT_EXECUTE) {
+      deps.emit({ kind: "tag", tag: "prepared_statement" });
+      awaitingResponse = true;
+    }
+  }
+  function handleServerPacket(payloadStart, payloadLen) {
+    if (!awaitingResponse)
+      return;
+    const first = serverBuf.byteAt(payloadStart);
+    if (first === undefined)
+      return;
+    if (first === 255) {
+      const code = serverBuf.readUInt16LE(payloadStart + 1);
+      let msgStart = payloadStart + 3;
+      if (serverBuf.byteAt(msgStart) === 35) {
+        msgStart += 6;
+      }
+      const message = serverBuf.text(msgStart, payloadStart + payloadLen);
+      deps.emit({ kind: "error", code: String(code), message });
+      awaitingResponse = false;
+    } else if (first === 0) {
+      deps.emit({ kind: "query_end", rowCount: null });
+      awaitingResponse = false;
+    } else {
+      deps.emit({ kind: "tag", tag: "parse_partial" });
+      deps.emit({ kind: "query_end", rowCount: null });
+      awaitingResponse = false;
+    }
+  }
+  function drain(buf, onPacket) {
+    while (buf.length >= HEADER) {
+      const payloadLen = buf.readUInt24LE(0);
+      if (buf.length < HEADER + payloadLen)
+        break;
+      onPacket(HEADER, payloadLen);
+      buf.consume(HEADER + payloadLen);
+    }
+  }
+  return {
+    onData(direction, chunk) {
+      try {
+        if (direction === "client_to_server") {
+          clientBuf.push(chunk);
+          drain(clientBuf, handleClientPacket);
+        } else {
+          serverBuf.push(chunk);
+          drain(serverBuf, handleServerPacket);
+        }
+      } catch (err) {
+        deps.emit({
+          kind: "parse_error",
+          message: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+  };
+}
+
+// src/proxy/analyzers/postgresql.ts
+function rowCountFromTag(tag) {
+  const parts = tag.trim().split(/\s+/);
+  const last = parts[parts.length - 1];
+  if (last === undefined)
+    return null;
+  const n = Number(last);
+  return Number.isInteger(n) ? n : null;
+}
+var MAX_STARTUP_LEN = 1e4;
+function createPostgresAnalyzer(deps) {
+  const clientBuf = new FrameBuffer;
+  const serverBuf = new FrameBuffer;
+  let startupSeen = false;
+  let awaitingResponse = false;
+  function cStringEnd(buf, start, end) {
+    let i = start;
+    while (i < end && buf.byteAt(i) !== 0)
+      i++;
+    return i;
+  }
+  function readCString(buf, start, end) {
+    return buf.text(start, cStringEnd(buf, start, end));
+  }
+  function handleClientMessage(type, bodyStart, bodyEnd) {
+    const t2 = String.fromCharCode(type);
+    if (t2 === "Q") {
+      const sql = readCString(clientBuf, bodyStart, bodyEnd);
+      deps.emit({ kind: "query", sql });
+      awaitingResponse = true;
+    } else if (t2 === "P" || t2 === "B" || t2 === "E" || t2 === "S" || t2 === "D") {
+      deps.emit({ kind: "tag", tag: "extended_protocol" });
+      if (t2 === "P") {
+        const nameEnd = cStringEnd(clientBuf, bodyStart, bodyEnd) + 1;
+        const sql = readCString(clientBuf, nameEnd, bodyEnd);
+        if (sql)
+          deps.emit({ kind: "query", sql, tags: ["extended_protocol"] });
+        awaitingResponse = true;
+      }
+    }
+  }
+  function handleServerMessage(type, bodyStart, bodyEnd) {
+    if (!awaitingResponse)
+      return;
+    const t2 = String.fromCharCode(type);
+    if (t2 === "E") {
+      let code = null;
+      let message = "";
+      let i = bodyStart;
+      while (i < bodyEnd) {
+        const fieldType = serverBuf.byteAt(i);
+        if (fieldType === undefined || fieldType === 0)
+          break;
+        i += 1;
+        const valEnd = cStringEnd(serverBuf, i, bodyEnd);
+        const value = serverBuf.text(i, valEnd);
+        i = valEnd + 1;
+        if (fieldType === 67)
+          code = value;
+        else if (fieldType === 77)
+          message = value;
+      }
+      deps.emit({ kind: "error", code, message });
+      awaitingResponse = false;
+    } else if (t2 === "C") {
+      const tag = readCString(serverBuf, bodyStart, bodyEnd);
+      deps.emit({ kind: "query_end", rowCount: rowCountFromTag(tag) });
+      awaitingResponse = false;
+    }
+  }
+  function drain(buf, isClient, onMessage) {
+    if (isClient && !startupSeen) {
+      if (buf.length < 4)
+        return;
+      const len = buf.readUInt32BE(0);
+      if (len >= 4 && len <= buf.length && len <= MAX_STARTUP_LEN) {
+        startupSeen = true;
+        buf.consume(len);
+      } else {
+        startupSeen = true;
+      }
+    }
+    while (buf.length >= 5) {
+      const type = buf.byteAt(0);
+      const len = buf.readUInt32BE(1);
+      const total = 1 + len;
+      if (buf.length < total)
+        break;
+      onMessage(type, 5, total);
+      buf.consume(total);
+    }
+  }
+  return {
+    onData(direction, chunk) {
+      try {
+        if (direction === "client_to_server") {
+          clientBuf.push(chunk);
+          drain(clientBuf, true, handleClientMessage);
+        } else {
+          serverBuf.push(chunk);
+          drain(serverBuf, false, handleServerMessage);
+        }
+      } catch (err) {
+        deps.emit({
+          kind: "parse_error",
+          message: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+  };
+}
+
+// src/proxy/server.ts
+function makeAnalyzer(engine, deps) {
+  return engine === "postgresql" ? createPostgresAnalyzer(deps) : createMysqlAnalyzer(deps);
+}
+
+class ProxyServer {
+  o;
+  writer;
+  listener = null;
+  sessionCounter = 0;
+  writeFailed = false;
+  constructor(opts) {
+    this.o = opts;
+    this.writer = new EventWriter({ path: opts.eventsPath, redact: opts.redact });
+  }
+  get port() {
+    return this.listener?.port ?? null;
+  }
+  async start() {
+    await this.writer.write({
+      version: PROXY_EVENT_VERSION,
+      type: "proxy_started",
+      timestamp: new Date().toISOString(),
+      engine: this.o.engine,
+      sessionId: "pxy_root",
+      listen: `${this.o.listen.host}:${this.o.listen.port}`,
+      target: `${this.o.target.host}:${this.o.target.port}`
+    });
+    this.listener = Bun.listen({
+      hostname: this.o.listen.host,
+      port: this.o.listen.port,
+      socket: {
+        open: (client) => {
+          this.handleConnection(client);
+        },
+        data(client, chunk) {
+          const ctx = client.data;
+          ctx?.onData?.(chunk);
+        },
+        close(client) {
+          const ctx = client.data;
+          ctx?.onClose?.();
+        },
+        error(client) {
+          const ctx = client.data;
+          ctx?.onClose?.();
+        }
+      }
+    });
+  }
+  stop() {
+    this.listener?.stop();
+    this.listener = null;
+  }
+  async handleConnection(client) {
+    if (this.writeFailed) {
+      client.end();
+      return;
+    }
+    this.sessionCounter += 1;
+    const sessionId = `pxy_${this.sessionCounter}`;
+    const clientAddr = client.remoteAddress ?? "unknown";
+    const target = `${this.o.target.host}:${this.o.target.port}`;
+    const earlyBuffer = [];
+    let relay = null;
+    client.data = {
+      onData: (chunk) => {
+        if (relay) {
+          relay.fromClient(chunk);
+        } else {
+          earlyBuffer.push(chunk);
+        }
+      },
+      onClose: () => {
+        client.end();
+      }
+    };
+    const session = new ProxySession({
+      sessionId,
+      engine: this.o.engine,
+      client: clientAddr,
+      target,
+      slowMs: this.o.slowMs,
+      now: () => performance.now(),
+      getBytes: () => ({
+        clientBytes: relay?.clientBytes ?? 0,
+        serverBytes: relay?.serverBytes ?? 0
+      }),
+      writeEvent: (e) => this.writer.write(e).catch((err) => {
+        this.writeFailed = true;
+        this.o.warn(`event write failed: ${err instanceof Error ? err.message : String(err)}`);
+      }),
+      warn: this.o.warn
+    });
+    let upstream;
+    try {
+      const analyzer = makeAnalyzer(this.o.engine, { emit: (s) => session.onSignal(s) });
+      upstream = await Bun.connect({
+        hostname: this.o.target.host,
+        port: this.o.target.port,
+        socket: {
+          data(_s, chunk) {
+            relay?.fromUpstream(chunk);
+          },
+          close() {
+            session.end("upstream_closed").then(() => client.end());
+          },
+          error() {
+            session.end("error").then(() => client.end());
+          }
+        }
+      });
+      relay = new TcpRelay({
+        writeToClient: (b) => {
+          client.write(b);
+        },
+        writeToUpstream: (b) => {
+          upstream.write(b);
+        },
+        analyzer,
+        onSignal: (s) => session.onSignal(s)
+      });
+      const liveUpstream = upstream;
+      client.data = {
+        onData: (chunk) => relay?.fromClient(chunk),
+        onClose: () => void session.end("client_closed").then(() => liveUpstream.end())
+      };
+      for (const chunk of earlyBuffer) {
+        relay.fromClient(chunk);
+      }
+      earlyBuffer.length = 0;
+    } catch (err) {
+      this.o.warn(`upstream connect failed: ${err instanceof Error ? err.message : String(err)}`);
+      await session.start();
+      await session.end("error");
+      client.end();
+      return;
+    }
+    try {
+      await session.start();
+    } catch (err) {
+      this.o.warn(`session start failed: ${err instanceof Error ? err.message : String(err)}`);
+      client.end();
+      upstream.end();
+      return;
+    }
+  }
+}
+
+// src/proxy/event-reader.ts
+import { readFile as readFile7 } from "fs/promises";
+async function readEvents(path6, opts) {
+  const candidates = opts.includeRotated ? [path6, `${path6}.1`] : [path6];
+  const files = [];
+  const events = [];
+  let malformedLines = 0;
+  for (const file of candidates) {
+    let raw;
+    try {
+      raw = await readFile7(file, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT")
+        throw err;
+      continue;
+    }
+    files.push(file);
+    for (const rawLine of raw.split(`
+`)) {
+      const trimmed = rawLine.trim();
+      if (!trimmed)
+        continue;
+      try {
+        events.push(JSON.parse(trimmed));
+      } catch {
+        malformedLines += 1;
+      }
+    }
+  }
+  events.sort((a, b) => a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0);
+  return { events, malformedLines, files };
+}
+
+// src/proxy/analyze.ts
+var isCompleted = (e) => e.type === "query_completed";
+var isErrored = (e) => e.type === "query_errored";
+function percentile(values, p) {
+  if (values.length === 0)
+    return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const rank = Math.ceil(p / 100 * sorted.length);
+  const idx = Math.min(Math.max(rank, 1), sorted.length) - 1;
+  return sorted[idx];
+}
+function fingerprintSql(sql) {
+  return redactLiterals(sql).replace(/\s+/g, " ").trim();
+}
+function shellEscapeDq(s) {
+  return s.replace(/\\/g, "\\\\").replace(/\$/g, "\\$").replace(/`/g, "\\`").replace(/"/g, "\\\"");
+}
+function buildByFingerprint(events, slowMs, top) {
+  const errorByFp = new Map;
+  for (const e of events.filter(isErrored)) {
+    const fp = fingerprintSql(e.sql);
+    errorByFp.set(fp, (errorByFp.get(fp) ?? 0) + 1);
+  }
+  const groups = new Map;
+  for (const e of events.filter(isCompleted)) {
+    const fp = fingerprintSql(e.sql);
+    let g = groups.get(fp);
+    if (!g) {
+      g = {
+        fingerprint: fp,
+        statement: e.statement,
+        tables: e.tables,
+        durations: [],
+        reqBytes: 0,
+        respBytes: 0,
+        rows: [],
+        slowCount: 0,
+        exampleSql: e.sql,
+        exampleQueryId: e.queryId,
+        exampleDuration: e.durationMs
+      };
+      groups.set(fp, g);
+    }
+    g.durations.push(e.durationMs);
+    g.reqBytes += e.requestBytes;
+    g.respBytes += e.responseBytes;
+    if (e.rowCount !== null)
+      g.rows.push(e.rowCount);
+    if (e.durationMs >= slowMs)
+      g.slowCount += 1;
+    if (e.durationMs > g.exampleDuration) {
+      g.exampleDuration = e.durationMs;
+      g.exampleSql = e.sql;
+      g.exampleQueryId = e.queryId;
+    }
+  }
+  const stats = [...groups.values()].map((g) => {
+    const count = g.durations.length;
+    const total = g.durations.reduce((sum, d) => sum + d, 0);
+    return {
+      fingerprint: g.fingerprint,
+      statement: g.statement,
+      tables: g.tables,
+      count,
+      durationMs: {
+        total,
+        avg: count ? Math.round(total / count) : 0,
+        p95: percentile(g.durations, 95),
+        max: count ? Math.max(...g.durations) : 0
+      },
+      rowsAvg: g.rows.length ? Math.round(g.rows.reduce((sum, r) => sum + r, 0) / g.rows.length) : 0,
+      bytesAvg: {
+        request: count ? Math.round(g.reqBytes / count) : 0,
+        response: count ? Math.round(g.respBytes / count) : 0
+      },
+      errorCount: errorByFp.get(g.fingerprint) ?? 0,
+      slowCount: g.slowCount,
+      redacted: redactLiterals(g.exampleSql) === g.exampleSql,
+      exampleSql: g.exampleSql,
+      exampleQueryId: g.exampleQueryId
+    };
+  });
+  stats.sort((a, b) => b.durationMs.total - a.durationMs.total);
+  return stats.map((s, i) => {
+    if (i < top && s.statement === "SELECT") {
+      const sql = shellEscapeDq(s.exampleSql);
+      return {
+        ...s,
+        suggestedCommands: [`dbcli explain "${sql}"`, `dbcli guide missing-index-for "${sql}"`]
+      };
+    }
+    return s;
+  });
+}
+function buildSlowest(events, top) {
+  return events.filter(isCompleted).sort((a, b) => b.durationMs - a.durationMs).slice(0, top).map((e) => ({
+    queryId: e.queryId,
+    durationMs: e.durationMs,
+    sql: e.sql,
+    statement: e.statement,
+    tables: e.tables,
+    timestamp: e.timestamp,
+    sessionId: e.sessionId
+  }));
+}
+function buildErrors(events) {
+  const groups = new Map;
+  for (const e of events.filter(isErrored)) {
+    const key = `${e.error.code ?? ""} ${e.error.message}`;
+    let g = groups.get(key);
+    if (!g) {
+      g = {
+        code: e.error.code,
+        message: e.error.message,
+        count: 0,
+        fingerprint: fingerprintSql(e.sql),
+        exampleSql: e.sql
+      };
+      groups.set(key, g);
+    }
+    g.count += 1;
+  }
+  return [...groups.values()].sort((a, b) => b.count - a.count);
+}
+function buildHotTables(events) {
+  const map = new Map;
+  for (const e of events.filter(isCompleted)) {
+    for (const t2 of e.tables) {
+      let g = map.get(t2);
+      if (!g) {
+        g = { queryCount: 0, totalDurationMs: 0 };
+        map.set(t2, g);
+      }
+      g.queryCount += 1;
+      g.totalDurationMs += e.durationMs;
+    }
+  }
+  return [...map.entries()].map(([table, g]) => ({ table, queryCount: g.queryCount, totalDurationMs: g.totalDurationMs })).sort((a, b) => b.queryCount - a.queryCount);
+}
+function buildRepetition(events, threshold) {
+  const groups = new Map;
+  for (const e of events.filter(isCompleted)) {
+    const fp = fingerprintSql(e.sql);
+    const key = `${e.sessionId} ${fp}`;
+    const ts = Date.parse(e.timestamp);
+    let g = groups.get(key);
+    if (!g) {
+      g = {
+        fingerprint: fp,
+        sessionId: e.sessionId,
+        tables: e.tables,
+        count: 0,
+        totalDurationMs: 0,
+        minTs: ts,
+        maxTs: ts
+      };
+      groups.set(key, g);
+    }
+    g.count += 1;
+    g.totalDurationMs += e.durationMs;
+    if (ts < g.minTs)
+      g.minTs = ts;
+    if (ts > g.maxTs)
+      g.maxTs = ts;
+  }
+  return [...groups.values()].filter((g) => g.count >= threshold).map((g) => ({
+    fingerprint: g.fingerprint,
+    sessionId: g.sessionId,
+    count: g.count,
+    spanMs: g.maxTs - g.minTs,
+    totalDurationMs: g.totalDurationMs,
+    tables: g.tables
+  })).sort((a, b) => b.count - a.count);
+}
+function analyzeEvents(events, opts) {
+  const timestamps = events.map((e) => e.timestamp).filter(Boolean).sort();
+  const from = timestamps[0] ?? null;
+  const to = timestamps[timestamps.length - 1] ?? null;
+  return {
+    version: 1,
+    tool: "proxy-analyze",
+    engine: events[0]?.engine ?? null,
+    source: {
+      files: opts.sourceFiles,
+      eventsRead: events.length,
+      malformedLines: opts.malformedLines,
+      timeSpan: {
+        from,
+        to,
+        durationMs: from && to ? Date.parse(to) - Date.parse(from) : 0
+      }
+    },
+    summary: buildSummary(events, opts.slowMs),
+    byFingerprint: buildByFingerprint(events, opts.slowMs, opts.top),
+    slowest: buildSlowest(events, opts.top),
+    errors: buildErrors(events),
+    hotTables: buildHotTables(events),
+    repetition: buildRepetition(events, opts.nPlusOne)
+  };
+}
+function buildSummary(events, slowMs) {
+  const completed = events.filter(isCompleted);
+  const errored = events.filter(isErrored);
+  const durations = completed.map((e) => e.durationMs);
+  const queries = completed.length;
+  const errors3 = errored.length;
+  const denom = queries + errors3;
+  return {
+    sessions: new Set(events.filter((e) => e.type === "session_started").map((e) => e.sessionId)).size,
+    queries,
+    errors: errors3,
+    errorRate: denom === 0 ? 0 : errors3 / denom,
+    parseErrors: events.filter((e) => e.type === "parse_error").length,
+    slowCount: completed.filter((e) => e.durationMs >= slowMs).length,
+    latencyMs: {
+      p50: percentile(durations, 50),
+      p95: percentile(durations, 95),
+      p99: percentile(durations, 99),
+      max: durations.length ? Math.max(...durations) : 0
+    },
+    bytes: {
+      request: completed.reduce((sum, e) => sum + e.requestBytes, 0),
+      response: completed.reduce((sum, e) => sum + e.responseBytes, 0)
+    }
+  };
+}
+
+// src/proxy/analyze-render.ts
+function renderAnalysisText(report, top) {
+  if (report.summary.queries === 0 && report.summary.errors === 0) {
+    return "no events to analyze";
+  }
+  const s = report.summary;
+  const L2 = [];
+  L2.push("SUMMARY");
+  L2.push(`  engine: ${report.engine ?? "unknown"}  sessions: ${s.sessions}  ` + `queries: ${s.queries}  errors: ${s.errors} (${(s.errorRate * 100).toFixed(2)}%)`);
+  L2.push(`  latency ms: p50=${s.latencyMs.p50} p95=${s.latencyMs.p95} ` + `p99=${s.latencyMs.p99} max=${s.latencyMs.max}  slow=${s.slowCount}`);
+  L2.push(`  bytes: req=${s.bytes.request} resp=${s.bytes.response}`);
+  L2.push("", "TOP QUERIES BY TOTAL TIME");
+  for (const f of report.byFingerprint.slice(0, top)) {
+    L2.push(`  [${f.count}x total=${f.durationMs.total}ms avg=${f.durationMs.avg} ` + `p95=${f.durationMs.p95}] ${f.fingerprint}`);
+  }
+  L2.push("", "SLOWEST SINGLE QUERIES");
+  for (const q3 of report.slowest.slice(0, top)) {
+    L2.push(`  ${q3.durationMs}ms  ${q3.sql}`);
+  }
+  L2.push("", "HOT TABLES");
+  for (const t2 of report.hotTables.slice(0, top)) {
+    L2.push(`  ${t2.queryCount}x  ${t2.totalDurationMs}ms  ${t2.table}`);
+  }
+  L2.push("", "ERRORS");
+  if (report.errors.length === 0)
+    L2.push("  (none)");
+  for (const e of report.errors.slice(0, top)) {
+    L2.push(`  ${e.count}x  [${e.code ?? "?"}] ${e.message}`);
+  }
+  L2.push("", "N+1 SUSPECTS");
+  if (report.repetition.length === 0)
+    L2.push("  (none)");
+  for (const r of report.repetition.slice(0, top)) {
+    L2.push(`  ${r.count}x in session ${r.sessionId} (${r.spanMs}ms)  ${r.fingerprint}`);
+  }
+  const cmds = [...new Set(report.byFingerprint.flatMap((f) => f.suggestedCommands ?? []))];
+  if (cmds.length) {
+    L2.push("", "SUGGESTED COMMANDS");
+    for (const c2 of cmds)
+      L2.push(`  ${c2}`);
+  }
+  return L2.join(`
+`);
+}
+
+// src/commands/proxy.ts
+var SUPPORTED = ["mysql", "mariadb", "postgresql"];
+var ALLOWED_FORMATS18 = ["text", "json"];
+var ALLOWED_REDACT = ["none", "literals"];
+function parseHostPort(value) {
+  const idx = value.lastIndexOf(":");
+  if (idx <= 0 || idx === value.length - 1) {
+    throw new Error(`Invalid address "${value}". Expected host:port`);
+  }
+  const host = value.slice(0, idx);
+  const port = Number(value.slice(idx + 1));
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error(`Invalid port in "${value}". Expected host:port with a numeric port`);
+  }
+  return { host, port };
+}
+function resolveProxyConfig(input) {
+  if (!input.listen) {
+    throw new Error("--listen <host:port> is required");
+  }
+  const listen = parseHostPort(input.listen);
+  let engine;
+  if (input.subcommandEngine) {
+    engine = input.subcommandEngine;
+  } else {
+    const sys = input.connection?.system;
+    if (!sys || !SUPPORTED.includes(sys)) {
+      throw new Error(`proxy supports mysql, mariadb, postgresql (got: ${sys ?? "none"})`);
+    }
+    engine = sys;
+  }
+  let target;
+  if (input.target) {
+    target = parseHostPort(input.target);
+  } else if (input.connection) {
+    target = { host: input.connection.host, port: input.connection.port };
+  } else {
+    throw new Error("--target <host:port> is required when config does not provide host/port");
+  }
+  return { engine, listen, target };
+}
+async function runProxy(subcommandEngine, options, command) {
+  try {
+    validateFormat(options.format ?? "text", ALLOWED_FORMATS18, "proxy");
+    const redact = options.redact ?? "none";
+    if (!ALLOWED_REDACT.includes(redact)) {
+      throw new Error(`Invalid --redact "${redact}". Allowed: none, literals`);
+    }
+    const configPath = resolveConfigPath(command, options);
+    let connection = null;
+    try {
+      const config = await configModule.read(configPath);
+      if (config.connection) {
+        connection = {
+          system: config.connection.system,
+          host: config.connection.host,
+          port: config.connection.port
+        };
+      }
+    } catch {}
+    const resolved = resolveProxyConfig({
+      subcommandEngine,
+      listen: options.listen,
+      target: options.target,
+      connection
+    });
+    const eventsPath = options.events ?? join32(".dbcli", "proxy", "events.jsonl");
+    const slowMs = Number(options.slowMs ?? 1000);
+    if (!Number.isFinite(slowMs) || slowMs < 0) {
+      throw new Error(`Invalid --slow-ms "${options.slowMs}". Expected a non-negative number`);
+    }
+    const server = new ProxyServer({
+      engine: resolved.engine,
+      listen: resolved.listen,
+      target: resolved.target,
+      eventsPath,
+      slowMs,
+      redact,
+      warn: (m) => process.stderr.write(`[proxy] ${m}
+`)
+    });
+    await server.start();
+    if (options.format === "json") {
+      process.stdout.write(JSON.stringify({
+        status: "listening",
+        engine: resolved.engine,
+        listen: `${resolved.listen.host}:${resolved.listen.port}`,
+        target: `${resolved.target.host}:${resolved.target.port}`,
+        events: eventsPath,
+        redact
+      }) + `
+`);
+    } else {
+      process.stdout.write(`dbcli proxy (${resolved.engine}) listening on ${resolved.listen.host}:${resolved.listen.port}` + ` -> ${resolved.target.host}:${resolved.target.port}
+` + `events: ${eventsPath} | slow-ms: ${slowMs} | redact: ${redact}
+` + `Press Ctrl+C to stop.
+`);
+    }
+    await new Promise((resolve5) => {
+      const shutdown = () => {
+        process.removeListener("SIGINT", shutdown);
+        process.removeListener("SIGTERM", shutdown);
+        server.stop();
+        resolve5();
+      };
+      process.on("SIGINT", shutdown);
+      process.on("SIGTERM", shutdown);
+    });
+  } catch (error) {
+    if (error instanceof Error)
+      console.error(error.message);
+    process.exit(1);
+  }
+}
+function addCommonOptions(cmd) {
+  return cmd.option("--listen <host:port>", "Local proxy listen address (required)").option("--target <host:port>", "Upstream DB target (optional when config provides host/port)").option("--events <path>", "Event JSONL path", join32(".dbcli", "proxy", "events.jsonl")).option("--slow-ms <number>", "Threshold (ms); queries at/above it get slow:true in the event + a terminal warning", "1000").option("--redact <mode>", "SQL redaction: none | literals", "none").option("--format <format>", "Runtime status output: text | json", "text");
+}
+var proxyCommand = new Command().name("proxy").description("Local development observability proxy for MySQL/MariaDB/PostgreSQL (observe-only)");
+proxyCommand.enablePositionalOptions();
+for (const engine of SUPPORTED) {
+  addCommonOptions(proxyCommand.command(engine).description(`Proxy a ${engine} connection`)).action(async (options, command) => {
+    await runProxy(engine, options, command);
+  });
+}
+var ANALYZE_FORMATS = ["json", "text"];
+function parseNonNegInt(value, flag, fallback) {
+  if (value === undefined)
+    return fallback;
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0) {
+    throw new Error(`Invalid --${flag} "${value}". Expected a non-negative integer`);
+  }
+  return n;
+}
+async function runAnalyze(options) {
+  try {
+    const format = options.format ?? "json";
+    validateFormat(format, ANALYZE_FORMATS, "proxy analyze");
+    const top = parseNonNegInt(options.top, "top", 20);
+    const slowMs = parseNonNegInt(options.slowMs, "slow-ms", 1000);
+    const nPlusOne = parseNonNegInt(options.nPlusOne, "n-plus-one", 10);
+    const eventsPath = options.events ?? join32(".dbcli", "proxy", "events.jsonl");
+    const { events, malformedLines, files } = await readEvents(eventsPath, {
+      includeRotated: options.includeRotated !== false
+    });
+    if (files.length === 0) {
+      throw new Error(`no events found at ${eventsPath}; run 'dbcli proxy <engine>' first`);
+    }
+    const report = analyzeEvents(events, {
+      slowMs,
+      top,
+      nPlusOne,
+      sourceFiles: files,
+      malformedLines
+    });
+    if (format === "text") {
+      process.stdout.write(renderAnalysisText(report, top) + `
+`);
+    } else {
+      process.stdout.write(JSON.stringify(report, null, 2) + `
+`);
+    }
+  } catch (error) {
+    if (error instanceof Error)
+      console.error(error.message);
+    process.exit(1);
+  }
+}
+proxyCommand.command("analyze").description("Analyze a proxy event log offline (no DB connection)").option("--events <path>", "Event JSONL path", join32(".dbcli", "proxy", "events.jsonl")).option("--format <format>", "Output format: json | text", "json").option("--top <number>", "Rows shown in text + suggestedCommands depth", "20").option("--slow-ms <number>", "Slow-query threshold (ms) for slowCount", "1000").option("--n-plus-one <number>", "Min repeats per (session,fingerprint) to flag N+1", "10").option("--no-include-rotated", "Do not merge the rotated <events>.1 segment").action(async (options) => {
+  await runAnalyze(options);
+});
+addCommonOptions(proxyCommand).action(async (options, command) => {
+  await runProxy(null, options, command);
+});
+
+// src/cli.ts
+init_config();
+import { join as join33 } from "path";
 var _bgVersionCheckResult;
 function shouldSkipBackgroundChecks() {
   return process.env.DBCLI_NO_UPDATE_CHECK === "1" || process.env.DBCLI_NO_UPDATE_CHECK === "true" || false;
 }
-var program2 = new Command().name("dbcli").description("Database CLI for AI agents").version(package_default.version).option("--no-color", "Disable colored output").option("-v, --verbose", "Increase verbosity (-v verbose, -vv debug)", (_, prev) => prev + 1, 0).option("-q, --quiet", "Suppress non-essential output").option("--config <path>", "Path to .dbcli config file", ".dbcli").option("--use <connection>", "Use a specific named connection (v2 config)");
+var program2 = new Command().name("dbcli").description("Database CLI for AI agents").version(package_default.version).option("--no-color", "Disable colored output").option("-v, --verbose", "Increase verbosity (-v verbose, -vv debug)", (_, prev) => prev + 1, 0).option("-q, --quiet", "Suppress non-essential output").option("--config <path>", "Path to .dbcli config file", ".dbcli").option("--use <connection>", "Use a specific named connection (v2 config)").enablePositionalOptions();
 program2.hook("preAction", (thisCommand, actionCommand) => {
   const opts = thisCommand.opts();
   const useConnection = opts.use;
@@ -94633,7 +95847,7 @@ program2.hook("preAction", (thisCommand, actionCommand) => {
       try {
         let cache = null;
         try {
-          const cacheFile = Bun.file(join32(configPath, "version-check.json"));
+          const cacheFile = Bun.file(join33(configPath, "version-check.json"));
           if (await cacheFile.exists()) {
             cache = await cacheFile.json();
           }
@@ -94755,6 +95969,7 @@ program2.addCommand(queriesCommand);
 program2.addCommand(explainCommand);
 program2.addCommand(snapshotCommand);
 program2.addCommand(assertCommand);
+program2.addCommand(proxyCommand);
 if (!process.argv.slice(2).length) {
   program2.outputHelp();
 }