dbctl 0.7.2__tar.gz → 0.7.4__tar.gz

{dbctl-0.7.2 → dbctl-0.7.4}/CHANGELOG.md

@@ -5,6 +5,73 @@ All notable changes to this project will be documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.4] — 2026-08-10
+
+### Added
+
+- **`dbctl ui`** — an interactive [Textual](https://textual.textualize.io/)
+  TUI on top of the same connections/operations/tunnels/audit-log stack as
+  the CLI (`textual` is a base dependency, no separate install step). See
+  `docs/tui.md` for the full reference.
+  - **Connection tree** doubling as a lazily-loaded schema browser: `m`
+    toggles a simple `connection → table → column` view and a fuller
+    `connection → schema → Tables/Views → table/view → Columns/Indexes`
+    view; `g` toggles a flat list and a grouping that treats `-` as a path
+    separator (`in-gateway-ifp-dev` nests under `in-gateway` → `ifp`), with
+    single-child folders compressed and support for a name that's both a
+    group and a real connection at once (`ifp` / `ifp-gateway`). `c`/`d`/`t`
+    connect/disconnect/test-tunnel; `a`/`e` open `connections.yaml` in
+    `$EDITOR`.
+  - **Tabbed workspace**: a SQL editor (syntax-highlighted) or an
+    operation-launcher (a form built from a declared operation's
+    parameters) per tab, each with an independently resizable results
+    table and a status line (row count / rows-affected + duration) below
+    it. `Ctrl+N` new tab, `Ctrl+O` searchable operation launcher (type to
+    filter), `Ctrl+W` close, `Ctrl+R` run. Activating a table/view in the
+    tree opens a SQL tab pre-filled with a dialect-correct preview query
+    (`LIMIT` / `TOP` / `FETCH FIRST … ROWS ONLY`, with per-dialect
+    identifier quoting for mixed-case table/schema names).
+  - Connect/disconnect/test-tunnel and every SQL/operation run happen on a
+    background thread with a loading indicator, so the UI stays responsive
+    instead of freezing while a tunnel spins up or a query runs.
+  - Every run still respects `safety.read_only` / `safety.confirm` /
+    `allowed_operations` and is appended to `~/.dbctl/history.jsonl`,
+    exactly like a CLI-driven run.
+
+### Fixed
+
+- **`uv.lock` could resolve against a contributor's local package-index
+  override instead of public PyPI** — a machine-level `uv` config pointing
+  at an internal package mirror silently became the index every regenerated
+  `uv.lock` entry was resolved and hashed against, which both leaked an
+  internal hostname into the lock file and broke `uv sync --frozen` for
+  anyone (CI included) without access to that mirror. Pinned
+  `[[tool.uv.index]]` in `pyproject.toml` with `default = true` so this
+  project always locks against `pypi.org`/`files.pythonhosted.org`
+  regardless of what index a contributor's environment defaults to.
+
+## [0.7.3] — 2026-08-04
+
+### Added
+
+- **`azure` tunnel type** — reaches a VM through Azure Bastion via
+  `az network bastion tunnel` (requires the Bastion resource on the
+  Standard SKU). New `AzureBastionTunnel` connection block
+  (`resource_group` / `bastion_name` / `target_resource_id` /
+  `subscription` / `remote_port` / `local_port`), same lifecycle
+  (subprocess + `atexit` cleanup, `local_port: 0` auto-pick) as the
+  existing `ssm` / `ssh` / `k8s` tunnels. Shells out to the `az` CLI —
+  no Azure SDK dependency.
+- **`gcp` tunnel type** — reaches a Compute Engine instance through
+  Identity-Aware Proxy via `gcloud compute start-iap-tunnel` (requires
+  IAP TCP forwarding on the instance's network and the
+  `roles/iap.tunnelResourceAccessor` IAM role). New `GcpIapTunnel`
+  connection block (`project` / `zone` / `instance` / `remote_port` /
+  `local_port`). Shells out to the `gcloud` CLI — no GCP SDK dependency.
+- Both new types are wired into `dbctl doctor` (reports `az`/`gcloud` on
+  `PATH`, only flagged `required` when a configured connection actually
+  uses them), `dbctl tunnel list`, and the `dbctl init` wizard.
+
 ## [0.7.2] — 2026-08-04
 
 ### Added

{dbctl-0.7.2 → dbctl-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dbctl
-Version: 0.7.2
+Version: 0.7.4
 Summary: Generic CLI to monitor, control, and administer multiple databases via SSM, SSH, or direct connection.
 Author: dbctl contributors
 License: MIT
@@ -25,8 +25,10 @@ Requires-Dist: pyodbc>=5
 Requires-Dist: pyyaml>=6
 Requires-Dist: rich>=13
 Requires-Dist: sqlalchemy>=2
+Requires-Dist: textual>=0.60
 Provides-Extra: dev
 Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=5; extra == 'dev'
 Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff>=0.5; extra == 'dev'
@@ -71,11 +73,13 @@ leaving the terminal.
 | DML is one `Ctrl-Enter` away                        | DML is **dry-run by default** until `--apply`; `--yes` skips the prompt |
 | No cross-DB diff                                     | `dbctl diff user-count prod-tenant1 int-tenant1`        |
 
-`dbctl` is **not** a schema browser or a query playground — it deliberately
-has no ad-hoc query command. Declaring operations in YAML keeps "what can be
-run against this DB" discoverable from a versioned file instead of buried in
-your shell history. (For ad-hoc exploration open the tunnel with
-`dbctl tunnel open <conn>` and point your favourite client at the local bind.)
+The declarative CLI above is still the primary interface: declaring
+operations in YAML keeps "what can be run against this DB" discoverable from
+a versioned file instead of buried in your shell history. For ad-hoc
+exploration, `dbctl ui` (see below) gives you a schema browser and a SQL
+editor without leaving `dbctl`'s tunnel/safety/audit model - or open the
+tunnel with `dbctl tunnel open <conn>` and point your favourite client at
+the local bind.
 
 ### How it reaches a database
 
@@ -85,6 +89,8 @@ your shell history. (For ad-hoc exploration open the tunnel with
 | `ssh`    | Classic `ssh -N -L` port-forward through a bastion             | `ssh` CLI on PATH, an SSH key file |
 | `k8s`    | `kubectl port-forward` to a Service / Pod in a cluster         | `kubectl` CLI on PATH, a valid kubeconfig |
 | `direct` | No tunnel — connect to the upstream host:port directly        | none |
+| `azure`  | Azure Bastion tunnel to a VM (`az network bastion tunnel`)     | `az` CLI on PATH, active `az login` session, Bastion on Standard SKU |
+| `gcp`    | IAP TCP tunnel to a Compute Engine instance (`gcloud compute start-iap-tunnel`) | `gcloud` CLI on PATH, active `gcloud auth login` session |
 
 Each connection declares its SQLAlchemy URL scheme (`postgresql+psycopg`,
 `mysql+pymysql`, `mariadb+pymysql`, `mssql+pyodbc`, `oracle+oracledb`,
@@ -145,9 +151,11 @@ uv pip install -e .
 uv run dbctl --help
 ```
 
-The `aws` and `ssh` binaries are expected on `PATH`. No `boto3`, no
-`paramiko` — dbctl always shells out so you keep your existing SSO session,
-key agents, and MFA flows.
+The `aws`, `ssh`, `az`, and `gcloud` binaries are expected on `PATH` (only
+the ones your configured tunnel types actually need — `dbctl doctor` tells
+you which). No `boto3`, no `paramiko`, no Azure/GCP SDKs — dbctl always
+shells out so you keep your existing SSO session, key agents, and MFA
+flows.
 
 ## Quick start with the bundled docker-compose fleet
 
@@ -348,6 +356,41 @@ reference.
 Secret-typed **operation** parameters (`type: secret`) are redacted in the
 audit log regardless of which DB password source the connection uses.
 
+## Interactive UI (`dbctl ui`)
+
+A [Textual](https://textual.textualize.io/) TUI for interactive work, on top
+of the same connections/operations/tunnels/audit-log stack as the CLI - not
+a separate code path with its own rules. `textual` is a base dependency, so
+no separate install step.
+
+```bash
+dbctl ui
+```
+
+- **Left pane**: a connection tree that doubles as a lazily-loaded schema
+  browser (`m` toggles a simple `connection → table → column` view and a
+  fuller `connection → schema → Tables/Views → table/view →
+  Columns/Indexes` view). Expanding a connection connects it if needed;
+  activating (Enter) a table/view opens a SQL tab pre-filled with a
+  dialect-correct preview query using the real table name. `g` toggles a
+  grouped view that treats `-` as a path separator (`in-gateway-ifp-dev`
+  nests under `in-gateway` → `ifp`) - handy once a fleet has more than a
+  handful of connections.
+- **Right pane**: a tabbed workspace of SQL editor / operation-launcher
+  tabs (`Ctrl+N` new tab, `Ctrl+O` searchable operation launcher, `Ctrl+W`
+  close, `Ctrl+R` run), each with an independently resizable results table
+  below it and a status line (row count / rows affected + duration) after
+  each run.
+- Connecting, disconnecting, testing a tunnel, and every SQL/operation run
+  happen on a background thread with a loading indicator, so the UI stays
+  responsive instead of freezing while a tunnel spins up or a query runs.
+- Every run still respects `safety.read_only` / `safety.confirm` /
+  `allowed_operations` and is appended to `~/.dbctl/history.jsonl`, exactly
+  like a CLI-driven run.
+
+See [`docs/tui.md`](docs/tui.md) for the full keybinding reference and
+per-dialect SQL details (row-limit clause, identifier quoting).
+
 ## Shell completion
 
 ```bash
@@ -371,6 +414,7 @@ dbctl/
 ├── docs/
 │   ├── connections.md      # connections.yaml reference
 │   ├── operations.md       # operations.yaml reference
+│   ├── tui.md              # dbctl ui reference (keybindings, dialect SQL)
 │   └── DESIGN.md           # architecture and design decisions
 └── dbctl/
     ├── cli.py              # dynamic groups + per-op Click commands
@@ -384,7 +428,21 @@ dbctl/
     ├── reports.py          # rich tables / json / csv / yaml + diff + copy/sync/validate rendering
     ├── audit.py            # history.jsonl
     ├── runtime.py          # opened_conn() ctx-mgr (tunnel+engine+healthcheck)
-    └── init.py             # dbctl init wizard
+    ├── init.py             # dbctl init wizard
+    └── ui/                 # Textual TUI (`dbctl ui`)
+        ├── app.py          # DbctlApp: connection tree + tabbed workspace
+        ├── session.py      # per-connection tunnel+engine kept open across tab-runs
+        ├── connection_tree.py  # lazy schema browser (simple/normal + flat/grouped views)
+        ├── grouping.py     # "-" as a path separator -> compressed connection-name trie
+        ├── schema.py       # sqlalchemy.inspect() wrapper for the tree
+        ├── editor_tab.py   # SQL editor tab
+        ├── operation_tab.py    # operation-launcher tab
+        ├── sql_templates.py    # dialect-aware default SELECT + identifier quoting
+        ├── screens.py      # confirm / new-tab / operation-launcher modal screens
+        ├── splitter.py     # draggable pane-resize bars
+        ├── tabs.py         # shared tab base: resize, toolbar, status bar, loading indicator
+        ├── results.py      # DataTable rendering helpers
+        └── registry.py     # tolerant connections/operations loading
 ```
 
 ## Development
@@ -393,7 +451,7 @@ dbctl/
 uv sync --extra dev
 make help            # list all Makefile targets
 make check           # lint + unit tests (the pre-commit gate)
-make test            # unit tests (~80 tests, in-memory SQLite, no docker)
+make test            # unit tests (~270 tests, sqlite-backed, no docker)
 make typecheck       # mypy strict (pre-existing debt; non-blocking)
 make smoke           # docker compose up + dbctl doctor against the fleet
 make build           # wheel + sdist via uv

{dbctl-0.7.2 → dbctl-0.7.4}/README.md

@@ -37,11 +37,13 @@ leaving the terminal.
 | DML is one `Ctrl-Enter` away                        | DML is **dry-run by default** until `--apply`; `--yes` skips the prompt |
 | No cross-DB diff                                     | `dbctl diff user-count prod-tenant1 int-tenant1`        |
 
-`dbctl` is **not** a schema browser or a query playground — it deliberately
-has no ad-hoc query command. Declaring operations in YAML keeps "what can be
-run against this DB" discoverable from a versioned file instead of buried in
-your shell history. (For ad-hoc exploration open the tunnel with
-`dbctl tunnel open <conn>` and point your favourite client at the local bind.)
+The declarative CLI above is still the primary interface: declaring
+operations in YAML keeps "what can be run against this DB" discoverable from
+a versioned file instead of buried in your shell history. For ad-hoc
+exploration, `dbctl ui` (see below) gives you a schema browser and a SQL
+editor without leaving `dbctl`'s tunnel/safety/audit model - or open the
+tunnel with `dbctl tunnel open <conn>` and point your favourite client at
+the local bind.
 
 ### How it reaches a database
 
@@ -51,6 +53,8 @@ your shell history. (For ad-hoc exploration open the tunnel with
 | `ssh`    | Classic `ssh -N -L` port-forward through a bastion             | `ssh` CLI on PATH, an SSH key file |
 | `k8s`    | `kubectl port-forward` to a Service / Pod in a cluster         | `kubectl` CLI on PATH, a valid kubeconfig |
 | `direct` | No tunnel — connect to the upstream host:port directly        | none |
+| `azure`  | Azure Bastion tunnel to a VM (`az network bastion tunnel`)     | `az` CLI on PATH, active `az login` session, Bastion on Standard SKU |
+| `gcp`    | IAP TCP tunnel to a Compute Engine instance (`gcloud compute start-iap-tunnel`) | `gcloud` CLI on PATH, active `gcloud auth login` session |
 
 Each connection declares its SQLAlchemy URL scheme (`postgresql+psycopg`,
 `mysql+pymysql`, `mariadb+pymysql`, `mssql+pyodbc`, `oracle+oracledb`,
@@ -111,9 +115,11 @@ uv pip install -e .
 uv run dbctl --help
 ```
 
-The `aws` and `ssh` binaries are expected on `PATH`. No `boto3`, no
-`paramiko` — dbctl always shells out so you keep your existing SSO session,
-key agents, and MFA flows.
+The `aws`, `ssh`, `az`, and `gcloud` binaries are expected on `PATH` (only
+the ones your configured tunnel types actually need — `dbctl doctor` tells
+you which). No `boto3`, no `paramiko`, no Azure/GCP SDKs — dbctl always
+shells out so you keep your existing SSO session, key agents, and MFA
+flows.
 
 ## Quick start with the bundled docker-compose fleet
 
@@ -314,6 +320,41 @@ reference.
 Secret-typed **operation** parameters (`type: secret`) are redacted in the
 audit log regardless of which DB password source the connection uses.
 
+## Interactive UI (`dbctl ui`)
+
+A [Textual](https://textual.textualize.io/) TUI for interactive work, on top
+of the same connections/operations/tunnels/audit-log stack as the CLI - not
+a separate code path with its own rules. `textual` is a base dependency, so
+no separate install step.
+
+```bash
+dbctl ui
+```
+
+- **Left pane**: a connection tree that doubles as a lazily-loaded schema
+  browser (`m` toggles a simple `connection → table → column` view and a
+  fuller `connection → schema → Tables/Views → table/view →
+  Columns/Indexes` view). Expanding a connection connects it if needed;
+  activating (Enter) a table/view opens a SQL tab pre-filled with a
+  dialect-correct preview query using the real table name. `g` toggles a
+  grouped view that treats `-` as a path separator (`in-gateway-ifp-dev`
+  nests under `in-gateway` → `ifp`) - handy once a fleet has more than a
+  handful of connections.
+- **Right pane**: a tabbed workspace of SQL editor / operation-launcher
+  tabs (`Ctrl+N` new tab, `Ctrl+O` searchable operation launcher, `Ctrl+W`
+  close, `Ctrl+R` run), each with an independently resizable results table
+  below it and a status line (row count / rows affected + duration) after
+  each run.
+- Connecting, disconnecting, testing a tunnel, and every SQL/operation run
+  happen on a background thread with a loading indicator, so the UI stays
+  responsive instead of freezing while a tunnel spins up or a query runs.
+- Every run still respects `safety.read_only` / `safety.confirm` /
+  `allowed_operations` and is appended to `~/.dbctl/history.jsonl`, exactly
+  like a CLI-driven run.
+
+See [`docs/tui.md`](docs/tui.md) for the full keybinding reference and
+per-dialect SQL details (row-limit clause, identifier quoting).
+
 ## Shell completion
 
 ```bash
@@ -337,6 +378,7 @@ dbctl/
 ├── docs/
 │   ├── connections.md      # connections.yaml reference
 │   ├── operations.md       # operations.yaml reference
+│   ├── tui.md              # dbctl ui reference (keybindings, dialect SQL)
 │   └── DESIGN.md           # architecture and design decisions
 └── dbctl/
     ├── cli.py              # dynamic groups + per-op Click commands
@@ -350,7 +392,21 @@ dbctl/
     ├── reports.py          # rich tables / json / csv / yaml + diff + copy/sync/validate rendering
     ├── audit.py            # history.jsonl
     ├── runtime.py          # opened_conn() ctx-mgr (tunnel+engine+healthcheck)
-    └── init.py             # dbctl init wizard
+    ├── init.py             # dbctl init wizard
+    └── ui/                 # Textual TUI (`dbctl ui`)
+        ├── app.py          # DbctlApp: connection tree + tabbed workspace
+        ├── session.py      # per-connection tunnel+engine kept open across tab-runs
+        ├── connection_tree.py  # lazy schema browser (simple/normal + flat/grouped views)
+        ├── grouping.py     # "-" as a path separator -> compressed connection-name trie
+        ├── schema.py       # sqlalchemy.inspect() wrapper for the tree
+        ├── editor_tab.py   # SQL editor tab
+        ├── operation_tab.py    # operation-launcher tab
+        ├── sql_templates.py    # dialect-aware default SELECT + identifier quoting
+        ├── screens.py      # confirm / new-tab / operation-launcher modal screens
+        ├── splitter.py     # draggable pane-resize bars
+        ├── tabs.py         # shared tab base: resize, toolbar, status bar, loading indicator
+        ├── results.py      # DataTable rendering helpers
+        └── registry.py     # tolerant connections/operations loading
 ```
 
 ## Development
@@ -359,7 +415,7 @@ dbctl/
 uv sync --extra dev
 make help            # list all Makefile targets
 make check           # lint + unit tests (the pre-commit gate)
-make test            # unit tests (~80 tests, in-memory SQLite, no docker)
+make test            # unit tests (~270 tests, sqlite-backed, no docker)
 make typecheck       # mypy strict (pre-existing debt; non-blocking)
 make smoke           # docker compose up + dbctl doctor against the fleet
 make build           # wheel + sdist via uv

{dbctl-0.7.2 → dbctl-0.7.4}/dbctl/cli.py

@@ -1020,7 +1020,7 @@ def _aliases(conns):
 
 def _root_list(ctx: click.Context) -> list[str]:
     conns, ops = registries(ctx)
-    static = ["connections", "operations", "status", "doctor", "init", "history", "tunnel"]
+    static = ["connections", "operations", "status", "doctor", "init", "history", "tunnel", "ui"]
     # multi-op operation-first top-level commands + deprecated verb-first groups
     multi_ops = {n for n, o in ops.items() if o.scope.value == "multi"}
     multi_modes = {o.mode.value for o in ops.values() if o.scope.value == "multi"}
@@ -1039,6 +1039,7 @@ def _root_get(ctx: click.Context, name: str):
         "init": init_cmd,
         "history": history_cmd,
         "tunnel": tunnel_cmd,
+        "ui": ui_cmd,
     }
     if name in static:
         return static[name]
@@ -1289,6 +1290,8 @@ def _doctor_deps(ctx, conns) -> None:
         ("kubectl", TunnelType.k8s, "install: https://kubernetes.io/docs/tasks/tools/"),
         ("aws", TunnelType.ssm, "install: `pip install awscli` or your OS package"),
         ("ssh", TunnelType.ssh, "install: OpenSSH client (openssh-clients / openssh-client)"),
+        ("az", TunnelType.azure, "install: https://learn.microsoft.com/cli/azure/install-azure-cli"),
+        ("gcloud", TunnelType.gcp, "install: https://cloud.google.com/sdk/docs/install"),
     ]
 
     dep_table = Table(title="optional dependencies", header_style="bold cyan")
@@ -1327,6 +1330,15 @@ def init_cmd(ctx):
     run_wizard(profile=ctx.obj.get("profile"))
 
 
+@click.command("ui")
+@click.pass_context
+def ui_cmd(ctx):
+    """Launch the interactive TUI: connection tree + tabbed SQL editor / operations."""
+    from dbctl.ui.app import DbctlApp
+
+    DbctlApp(profile=ctx.obj.get("profile")).run()
+
+
 @main.group("history")
 def history_cmd():
     """Show the audit log."""
@@ -1367,6 +1379,8 @@ def tunnel_cmd():
     - ssh:    Classic ssh -N -L port-forward through a bastion
     - k8s:    kubectl port-forward to a Service or Pod
     - direct: No tunnel — connect to upstream host:port
+    - azure:  Azure Bastion tunnel to a VM (az network bastion tunnel)
+    - gcp:    GCP IAP TCP tunnel to a Compute Engine instance (gcloud compute start-iap-tunnel)
 
     \b
     Subcommands:
@@ -1507,6 +1521,18 @@ def tunnel_list(ctx):
             if c.k8s.namespace:
                 info_parts.append(f"ns={c.k8s.namespace}")
             info_parts.append(f"port={c.k8s.remote_port}")
+        elif ttype == "azure":
+            assert c.azure
+            info_parts.append(f"bastion={c.azure.bastion_name}")
+            info_parts.append(f"target={c.azure.target_resource_id}")
+            info_parts.append(f"port={c.azure.remote_port}")
+        elif ttype == "gcp":
+            assert c.gcp
+            info_parts.append(f"instance={c.gcp.instance}")
+            info_parts.append(f"zone={c.gcp.zone}")
+            if c.gcp.project:
+                info_parts.append(f"project={c.gcp.project}")
+            info_parts.append(f"port={c.gcp.remote_port}")
         table.add_row(name, ttype, driver, ", ".join(info_parts))
 
     console.print(table)

{dbctl-0.7.2 → dbctl-0.7.4}/dbctl/config.py

@@ -26,6 +26,8 @@ class TunnelType(StrEnum):
     ssh = "ssh"
     k8s = "k8s"
     direct = "direct"
+    azure = "azure"
+    gcp = "gcp"
 
 
 class OpScope(StrEnum):
@@ -146,6 +148,37 @@ class DirectTunnel(BaseModel):
     port: int = 5432
 
 
+class AzureBastionTunnel(BaseModel):
+    """Azure Bastion tunnel via ``az network bastion tunnel`` subprocess.
+
+    Requires an Azure Bastion resource on the Standard SKU (native client
+    support / tunnel command needs Standard, not Basic) in the target VM's
+    VNet.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+    resource_group: str
+    bastion_name: str
+    target_resource_id: str  # full ARM resource id of the target VM
+    subscription: str | None = None  # az CLI --subscription (name or id)
+    remote_port: int = 5432  # --resource-port on the target VM
+    local_port: int = 0  # 0 = auto-pick free port
+
+
+class GcpIapTunnel(BaseModel):
+    """GCP Identity-Aware Proxy TCP tunnel via ``gcloud compute
+    start-iap-tunnel`` subprocess. Requires IAP TCP forwarding enabled on
+    the target instance's network and the caller to have the
+    ``roles/iap.tunnelResourceAccessor`` IAM role."""
+
+    model_config = ConfigDict(extra="forbid")
+    project: str | None = None  # gcloud --project; omit to use the CLI's active project
+    zone: str
+    instance: str
+    remote_port: int = 5432  # port on the instance to forward
+    local_port: int = 0  # 0 = auto-pick free port
+
+
 # --------------------------------------------------------------------------- #
 # info / healthcheck
 # --------------------------------------------------------------------------- #
@@ -194,6 +227,8 @@ class Connection(BaseModel):
     ssh: SshTunnel | None = None
     k8s: K8sTunnel | None = None
     direct: DirectTunnel | None = None
+    azure: AzureBastionTunnel | None = None
+    gcp: GcpIapTunnel | None = None
 
     healthcheck: Healthcheck = Field(default_factory=Healthcheck)
     info: list[InfoQuery] = Field(default_factory=list)
@@ -214,6 +249,12 @@ class Connection(BaseModel):
             case TunnelType.direct:
                 if self.direct is None:
                     raise ValueError("'direct' block required when type=direct")
+            case TunnelType.azure:
+                if self.azure is None:
+                    raise ValueError("'azure' block required when type=azure")
+            case TunnelType.gcp:
+                if self.gcp is None:
+                    raise ValueError("'gcp' block required when type=gcp")
 
         if self.url is not None:
             # Full-URL mode: driver/database/username/password fields are all

{dbctl-0.7.2 → dbctl-0.7.4}/dbctl/db.py

@@ -60,7 +60,7 @@ def resolve_password(conn: Connection) -> str | None:
     raise DBError("no password source configured")
 
 
-def _driver_name(conn: Connection) -> str:
+def driver_name(conn: Connection) -> str:
     """Return the SQLAlchemy driver scheme for this connection.
 
     When the user provides a full ``url:`` string, the driver is the
@@ -79,7 +79,7 @@ def _driver_name(conn: Connection) -> str:
 def _connect_args(conn: Connection, timeout: float) -> dict:
     """Driver-specific connect-time knobs (mainly connect_timeout)."""
     args: dict = {}
-    driver = _driver_name(conn)
+    driver = driver_name(conn)
     if driver.startswith(("postgresql", "mysql", "mariadb", "oracle")):
         args["connect_timeout"] = int(max(1, timeout))
     # sqlite + duckdb are file-based — no connect_timeout; SQLAlchemy
@@ -111,7 +111,7 @@ def build_engine(conn: Connection, tunnel: Tunnel, *, echo: bool = False) -> Eng
 
     conn = resolve_connection(conn)
 
-    driver = _driver_name(conn)
+    driver = driver_name(conn)
     _check_driver_available(driver)
 
     from sqlalchemy import URL, make_url
@@ -264,4 +264,12 @@ def fmt_db_error(e: BaseException) -> str:
     return msg
 
 
-__all__ = ["build_engine", "resolve_password", "healthcheck", "DBError", "fmt_db_error", "text"]
+__all__ = [
+    "build_engine",
+    "resolve_password",
+    "healthcheck",
+    "DBError",
+    "fmt_db_error",
+    "driver_name",
+    "text",
+]

{dbctl-0.7.2 → dbctl-0.7.4}/dbctl/init.py

@@ -12,8 +12,10 @@ import yaml
 from rich.console import Console
 
 from dbctl.config import (
+    AzureBastionTunnel,
     Connection,
     DirectTunnel,
+    GcpIapTunnel,
     Healthcheck,
     K8sTunnel,
     SshTunnel,
@@ -44,7 +46,7 @@ def run_wizard(*, profile: str | None) -> None:
         default=False,
     )
 
-    ssm = ssh = k8s = direct = None
+    ssm = ssh = k8s = direct = azure = gcp = None
     url = None
     driver = None
     database = None
@@ -113,6 +115,10 @@ def run_wizard(*, profile: str | None) -> None:
             ssh = _ask_ssh()
         elif type_ == "k8s":
             k8s = _ask_k8s()
+        elif type_ == "azure":
+            azure = _ask_azure()
+        elif type_ == "gcp":
+            gcp = _ask_gcp()
         else:
             host = click.prompt("host", default="localhost")
             port = click.prompt("port", type=int, default=_default_port(driver or ""))
@@ -138,6 +144,8 @@ def run_wizard(*, profile: str | None) -> None:
         ssh=ssh,
         k8s=k8s,
         direct=direct,
+        azure=azure,
+        gcp=gcp,
         healthcheck=healthcheck,
         safety={"confirm": confirm, "read_only": read_only},
     )
@@ -215,6 +223,38 @@ def _ask_k8s() -> K8sTunnel:
     )
 
 
+def _ask_azure() -> AzureBastionTunnel:
+    resource_group = click.prompt("resource group", type=str)
+    bastion_name = click.prompt("bastion name", type=str)
+    target_resource_id = click.prompt("target VM resource id (full ARM resource id)", type=str)
+    subscription = click.prompt("azure subscription (name or id, optional)", default="")
+    remote_port = click.prompt("remote port (on the target VM)", type=int, default=5432)
+    local_port = click.prompt("local port (0 = auto)", type=int, default=0)
+    return AzureBastionTunnel(
+        resource_group=resource_group,
+        bastion_name=bastion_name,
+        target_resource_id=target_resource_id,
+        subscription=subscription or None,
+        remote_port=remote_port,
+        local_port=local_port,
+    )
+
+
+def _ask_gcp() -> GcpIapTunnel:
+    project = click.prompt("gcp project (optional; blank = gcloud's active project)", default="")
+    zone = click.prompt("zone", type=str)
+    instance = click.prompt("instance name", type=str)
+    remote_port = click.prompt("remote port (on the instance)", type=int, default=5432)
+    local_port = click.prompt("local port (0 = auto)", type=int, default=0)
+    return GcpIapTunnel(
+        project=project or None,
+        zone=zone,
+        instance=instance,
+        remote_port=remote_port,
+        local_port=local_port,
+    )
+
+
 def _default_port(driver: str) -> int:
     if driver.startswith("postgresql"):
         return 5432