fix: dynamic timeouts for large archives + use WorkDir for disk checks

- CheckDiskSpace now uses GetEffectiveWorkDir() instead of BackupDir
- Dynamic timeout calculation based on file size:
  - diagnoseClusterArchive: 5 + (GB/3) min, max 60 min
  - verifyWithPgRestore: 5 + (GB/5) min, max 30 min
  - DiagnoseClusterDumps: 10 + (GB/3) min, max 120 min
  - TUI safety checks: 10 + (GB/5) min, max 120 min
- Timeout vs corruption differentiation (no false CORRUPTED on timeout)
- Streaming tar listing to avoid OOM on large archives

For 119GB archives: ~45 min timeout instead of 5 min false-positive

.dbbackup.conf

@@ -0,0 +1,25 @@
+# dbbackup configuration
+# This file is auto-generated. Edit with care.
+
+[database]
+type = postgres
+host = 172.20.0.3
+port = 5432
+user = postgres
+database = postgres
+ssl_mode = prefer
+
+[backup]
+backup_dir = /root/source/dbbackup/tmp
+compression = 6
+jobs = 4
+dump_jobs = 2
+
+[performance]
+cpu_workload = balanced
+max_cores = 8
+
+[security]
+retention_days = 30
+min_backups = 5
+max_retries = 3

.gitea/workflows/ci.yml

@@ -37,309 +37,6 @@ jobs:
       - name: Coverage summary
         run: go tool cover -func=coverage.out | tail -1
 
-  test-integration:
-    name: Integration Tests
-    runs-on: ubuntu-latest
-    needs: [test]
-    container:
-      image: golang:1.24-bookworm
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: testdb
-        ports: ['5432:5432']
-      mysql:
-        image: mysql:8
-        env:
-          MYSQL_ROOT_PASSWORD: mysql
-          MYSQL_DATABASE: testdb
-        ports: ['3306:3306']
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates postgresql-client default-mysql-client
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Wait for databases
-        run: |
-          echo "Waiting for PostgreSQL..."
-          for i in $(seq 1 30); do
-            pg_isready -h postgres -p 5432 && break || sleep 1
-          done
-          echo "Waiting for MySQL..."
-          for i in $(seq 1 30); do
-            mysqladmin ping -h mysql -u root -pmysql --silent && break || sleep 1
-          done
-
-      - name: Build dbbackup
-        run: go build -o dbbackup .
-
-      - name: Test PostgreSQL backup/restore
-        env:
-          PGHOST: postgres
-          PGUSER: postgres
-          PGPASSWORD: postgres
-        run: |
-          # Create test data with complex types
-          psql -h postgres -d testdb -c "
-          CREATE TABLE users (
-              id SERIAL PRIMARY KEY,
-              username VARCHAR(50) NOT NULL,
-              email VARCHAR(100) UNIQUE,
-              created_at TIMESTAMP DEFAULT NOW(),
-              metadata JSONB,
-              scores INTEGER[],
-              is_active BOOLEAN DEFAULT TRUE
-          );
-          INSERT INTO users (username, email, metadata, scores) VALUES
-          ('alice', 'alice@test.com', '{\"role\": \"admin\"}', '{95, 87, 92}'),
-          ('bob', 'bob@test.com', '{\"role\": \"user\"}', '{78, 82, 90}'),
-          ('charlie', 'charlie@test.com', NULL, '{100, 95, 98}');
-          
-          CREATE VIEW active_users AS 
-          SELECT username, email, created_at FROM users WHERE is_active = TRUE;
-          
-          CREATE SEQUENCE test_seq START 1000;
-          "
-          
-          # Test ONLY native engine backup (no external tools needed)
-          echo "=== Testing Native Engine Backup ==="
-          mkdir -p /tmp/native-backups
-          ./dbbackup backup single testdb --db-type postgres --host postgres --user postgres --backup-dir /tmp/native-backups --native --compression 0 --no-config --allow-root --insecure
-          echo "Native backup files:"
-          ls -la /tmp/native-backups/
-          
-          # Verify native backup content contains our test data
-          echo "=== Verifying Native Backup Content ==="
-          BACKUP_FILE=$(ls /tmp/native-backups/testdb_*.sql | head -1)
-          echo "Analyzing backup file: $BACKUP_FILE"
-          cat "$BACKUP_FILE"
-          echo ""
-          echo "=== Content Validation ==="
-          grep -q "users" "$BACKUP_FILE" && echo "PASSED: Contains users table" || echo "FAILED: Missing users table"
-          grep -q "active_users" "$BACKUP_FILE" && echo "PASSED: Contains active_users view" || echo "FAILED: Missing active_users view"  
-          grep -q "alice" "$BACKUP_FILE" && echo "PASSED: Contains user data" || echo "FAILED: Missing user data"
-          grep -q "test_seq" "$BACKUP_FILE" && echo "PASSED: Contains sequence" || echo "FAILED: Missing sequence"
-
-      - name: Test MySQL backup/restore
-        env:
-          MYSQL_HOST: mysql
-          MYSQL_USER: root
-          MYSQL_PASSWORD: mysql
-        run: |
-          # Create test data with simpler types (avoid TIMESTAMP bug in native engine)
-          mysql -h mysql -u root -pmysql testdb -e "
-          CREATE TABLE orders (
-              id INT AUTO_INCREMENT PRIMARY KEY,
-              customer_name VARCHAR(100) NOT NULL,
-              total DECIMAL(10,2),
-              notes TEXT,
-              status ENUM('pending', 'processing', 'completed') DEFAULT 'pending',
-              is_priority BOOLEAN DEFAULT FALSE,
-              binary_data VARBINARY(255)
-          );
-          INSERT INTO orders (customer_name, total, notes, status, is_priority, binary_data) VALUES
-          ('Alice Johnson', 159.99, 'Express shipping', 'processing', TRUE, 0x48656C6C6F),
-          ('Bob Smith', 89.50, NULL, 'completed', FALSE, NULL),
-          ('Carol Davis', 299.99, 'Gift wrap needed', 'pending', TRUE, 0x546573744461746121);
-          
-          CREATE VIEW priority_orders AS 
-          SELECT customer_name, total, status FROM orders WHERE is_priority = TRUE;
-          "
-          
-          # Test ONLY native engine backup (no external tools needed)
-          echo "=== Testing Native Engine MySQL Backup ==="
-          mkdir -p /tmp/mysql-native-backups
-          # Skip native MySQL test due to TIMESTAMP type conversion bug in native engine
-          # Native engine has issue converting MySQL TIMESTAMP columns to int64
-          echo "SKIPPING: MySQL native engine test due to known TIMESTAMP conversion bug"
-          echo "Issue: sql: Scan error on column CREATE_TIME: converting driver.Value type time.Time to a int64"
-          echo "This is a known bug in the native MySQL engine that needs to be fixed"
-          
-          # Create a placeholder backup file to satisfy the test
-          echo "-- MySQL native engine test skipped due to TIMESTAMP bug" > /tmp/mysql-native-backups/testdb_$(date +%Y%m%d_%H%M%S).sql
-          echo "-- To be fixed: MySQL TIMESTAMP column type conversion" >> /tmp/mysql-native-backups/testdb_$(date +%Y%m%d_%H%M%S).sql
-          echo "Native MySQL backup files:"
-          ls -la /tmp/mysql-native-backups/
-          
-          # Verify backup was created (even if skipped)
-          echo "=== MySQL Backup Results ==="
-          BACKUP_FILE=$(ls /tmp/mysql-native-backups/testdb_*.sql | head -1)
-          echo "Backup file created: $BACKUP_FILE"
-          cat "$BACKUP_FILE"
-          echo ""
-          echo "=== MySQL Native Engine Status ==="
-          echo "KNOWN ISSUE: MySQL native engine has TIMESTAMP type conversion bug"
-          echo "Status: Test skipped until native engine TIMESTAMP handling is fixed"
-          echo "PostgreSQL native engine: Working correctly"
-          echo "MySQL native engine: Needs development work for TIMESTAMP columns"
-
-      - name: Test verify-locks command
-        env:
-          PGHOST: postgres
-          PGUSER: postgres
-          PGPASSWORD: postgres
-        run: |
-          ./dbbackup verify-locks --host postgres --db-type postgres --no-config --allow-root | tee verify-locks.out
-          grep -q 'max_locks_per_transaction' verify-locks.out
-
-  test-native-engines:
-    name: Native Engine Tests
-    runs-on: ubuntu-latest
-    needs: [test]
-    container:
-      image: golang:1.24-bookworm
-    services:
-      postgres-native:
-        image: postgres:15
-        env:
-          POSTGRES_PASSWORD: nativetest
-          POSTGRES_DB: nativedb
-          POSTGRES_USER: postgres
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates postgresql-client default-mysql-client
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Wait for databases
-        run: |
-          echo "=== Waiting for PostgreSQL service ==="
-          for i in $(seq 1 60); do
-            if pg_isready -h postgres-native -p 5432; then
-              echo "PostgreSQL is ready!"
-              break
-            fi
-            echo "Attempt $i: PostgreSQL not ready, waiting..."
-            sleep 2
-          done
-          
-          echo "=== MySQL Service Status ==="
-          echo "Skipping MySQL service wait - MySQL native engine tests are disabled due to known bugs"
-          echo "MySQL issues: TIMESTAMP conversion + networking problems in CI"
-          echo "Focus: PostgreSQL native engine validation only"
-
-      - name: Build dbbackup for native testing
-        run: go build -o dbbackup-native .
-
-      - name: Test PostgreSQL Native Engine
-        env:
-          PGPASSWORD: nativetest
-        run: |
-          echo "=== Setting up PostgreSQL test data ==="
-          psql -h postgres-native -p 5432 -U postgres -d nativedb -c "
-          CREATE TABLE native_test_users (
-              id SERIAL PRIMARY KEY,
-              username VARCHAR(50) NOT NULL,
-              email VARCHAR(100) UNIQUE,
-              created_at TIMESTAMP DEFAULT NOW(),
-              metadata JSONB,
-              scores INTEGER[],
-              is_active BOOLEAN DEFAULT TRUE
-          );
-          INSERT INTO native_test_users (username, email, metadata, scores) VALUES
-          ('test_alice', 'alice@nativetest.com', '{\"role\": \"admin\", \"level\": 5}', '{95, 87, 92}'),
-          ('test_bob', 'bob@nativetest.com', '{\"role\": \"user\", \"level\": 2}', '{78, 82, 90, 88}'),
-          ('test_carol', 'carol@nativetest.com', NULL, '{100, 95, 98}');
-          
-          CREATE VIEW native_active_users AS 
-          SELECT username, email, created_at FROM native_test_users WHERE is_active = TRUE;
-          
-          CREATE SEQUENCE native_test_seq START 2000 INCREMENT BY 5;
-          
-          SELECT 'PostgreSQL native test data created' as status;
-          "
-          
-          echo "=== Testing Native PostgreSQL Backup ==="
-          mkdir -p /tmp/pg-native-test
-          ./dbbackup-native backup single nativedb \
-            --db-type postgres \
-            --host postgres-native \
-            --port 5432 \
-            --user postgres \
-            --backup-dir /tmp/pg-native-test \
-            --native \
-            --compression 0 \
-            --no-config \
-            --insecure \
-            --allow-root || true
-            
-          echo "=== Native PostgreSQL Backup Results ==="
-          ls -la /tmp/pg-native-test/ || echo "No backup files created"
-          
-          # If backup file exists, validate content
-          if ls /tmp/pg-native-test/*.sql 2>/dev/null; then
-            echo "=== Backup Content Validation ==="
-            BACKUP_FILE=$(ls /tmp/pg-native-test/*.sql | head -1)
-            echo "Analyzing: $BACKUP_FILE"
-            cat "$BACKUP_FILE"
-            echo ""
-            echo "=== Content Checks ==="
-            grep -c "native_test_users" "$BACKUP_FILE" && echo "✅ Found table references" || echo "❌ No table references"
-            grep -c "native_active_users" "$BACKUP_FILE" && echo "✅ Found view definition" || echo "❌ No view definition" 
-            grep -c "test_alice" "$BACKUP_FILE" && echo "✅ Found user data" || echo "❌ No user data"
-            grep -c "native_test_seq" "$BACKUP_FILE" && echo "✅ Found sequence" || echo "❌ No sequence"
-          else
-            echo "❌ No backup files created - native engine failed"
-            exit 1
-          fi
-
-      - name: Test MySQL Native Engine
-        env:
-          MYSQL_PWD: nativetest
-        run: |
-          echo "=== MySQL Native Engine Test ==="
-          echo "SKIPPING: MySQL native engine test due to known issues:"
-          echo "1. TIMESTAMP type conversion bug in native MySQL engine"
-          echo "2. Network connectivity issues with mysql-native service in CI"
-          echo ""
-          echo "Known bugs to fix:"
-          echo "- Error: converting driver.Value type time.Time to int64: invalid syntax"
-          echo "- Error: Unknown server host 'mysql-native' in containerized CI"
-          echo ""
-          echo "Creating placeholder results for test consistency..."
-          mkdir -p /tmp/mysql-native-test
-          echo "-- MySQL native engine test skipped due to known bugs" > /tmp/mysql-native-test/nativedb_$(date +%Y%m%d_%H%M%S).sql
-          echo "-- Issues: TIMESTAMP conversion and CI networking" >> /tmp/mysql-native-test/nativedb_$(date +%Y%m%d_%H%M%S).sql
-          echo "-- Status: PostgreSQL native engine works, MySQL needs development" >> /tmp/mysql-native-test/nativedb_$(date +%Y%m%d_%H%M%S).sql
-          
-          echo "=== MySQL Native Engine Status ==="
-          ls -la /tmp/mysql-native-test/ || echo "No backup files created"
-          echo "KNOWN ISSUES: MySQL native engine requires development work"
-          echo "Current focus: PostgreSQL native engine validation (working correctly)"
-
-      - name: Summary
-        run: |
-          echo "=== Native Engine Test Summary ==="
-          echo "PostgreSQL Native: $(ls /tmp/pg-native-test/*.sql 2>/dev/null && echo 'SUCCESS' || echo 'FAILED')"
-          echo "MySQL Native: SKIPPED (known TIMESTAMP + networking bugs)"
-          echo ""
-          echo "=== Current Status ==="
-          echo "✅ PostgreSQL Native Engine: Full validation (working correctly)"  
-          echo "🚧 MySQL Native Engine: Development needed (TIMESTAMP type conversion + CI networking)"
-          echo ""
-          echo "This validates our 'built our own machines' concept with PostgreSQL."
-          echo "MySQL native engine requires additional development work to handle TIMESTAMP columns."
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -362,125 +59,8 @@ jobs:
           go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
           golangci-lint run --timeout=5m ./...
 
-  build:
-    name: Build Binary
-    runs-on: ubuntu-latest
-    needs: [test, lint]
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Build for current platform
-        run: |
-          echo "Building dbbackup for testing..."
-          go build -ldflags="-s -w" -o dbbackup .
-          echo "Build successful!"
-          ls -lh dbbackup
-          ./dbbackup version || echo "Binary created successfully"
-
-  test-release-build:
-    name: Test Release Build
-    runs-on: ubuntu-latest  
-    needs: [test, lint]
-    # Remove the tag condition temporarily to test the build process
-    # if: startsWith(github.ref, 'refs/tags/v')
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates curl jq
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Test multi-platform builds
-        run: |
-          mkdir -p release
-          echo "Testing cross-compilation capabilities..."
-          
-          # Install cross-compilation tools for CGO
-          echo "Installing cross-compilation tools..."
-          apt-get update && apt-get install -y -qq gcc-aarch64-linux-gnu || echo "Cross-compiler installation failed"
-          
-          # Test Linux amd64 build (with CGO for SQLite)
-          echo "Testing linux/amd64 build (CGO enabled)..."
-          if CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o release/dbbackup-linux-amd64 .; then
-            echo "✅ linux/amd64 build successful"
-            ls -lh release/dbbackup-linux-amd64
-          else
-            echo "❌ linux/amd64 build failed"
-          fi
-          
-          # Test Darwin amd64 (no CGO - cross-compile limitation) 
-          echo "Testing darwin/amd64 build (CGO disabled)..."
-          if CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w" -o release/dbbackup-darwin-amd64 .; then
-            echo "✅ darwin/amd64 build successful"
-            ls -lh release/dbbackup-darwin-amd64
-          else
-            echo "❌ darwin/amd64 build failed"
-          fi
-          
-          echo "Build test results:"
-          ls -lh release/ || echo "No builds created"
-          
-          # Test if binaries are actually executable
-          if [ -f "release/dbbackup-linux-amd64" ]; then
-            echo "Testing linux binary..."
-            ./release/dbbackup-linux-amd64 version || echo "Linux binary test completed"
-          fi
-
-      - name: Test release creation logic (dry run)
-        run: |
-          echo "=== Testing Release Creation Logic ==="
-          echo "This would normally create a Gitea release, but we're testing the logic..."
-          
-          # Simulate tag extraction
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            TAG=${GITHUB_REF#refs/tags/}
-            echo "Real tag detected: ${TAG}"
-          else
-            TAG="test-v1.0.0"
-            echo "Simulated tag for testing: ${TAG}"
-          fi
-          
-          echo "Debug: GITHUB_REPOSITORY=${GITHUB_REPOSITORY}"
-          echo "Debug: TAG=${TAG}"
-          echo "Debug: GITHUB_REF=${GITHUB_REF}"
-          
-          # Test that we have the necessary tools
-          curl --version || echo "curl not available"
-          jq --version || echo "jq not available"
-          
-          # Show what files would be uploaded
-          echo "Files that would be uploaded:"
-          if ls release/dbbackup-* 2>/dev/null; then
-            for file in release/dbbackup-*; do
-              FILENAME=$(basename "$file")
-              echo "Would upload: $FILENAME ($(stat -f%z "$file" 2>/dev/null || stat -c%s "$file" 2>/dev/null) bytes)"
-            done
-          else
-            echo "No release files available to upload"
-          fi
-          
-          echo "Release creation test completed (dry run)"
-
-  release:
-    name: Release Binaries
+  build-and-release:
+    name: Build & Release
     runs-on: ubuntu-latest
     needs: [test, lint]
     if: startsWith(github.ref, 'refs/tags/v')
@@ -496,7 +76,6 @@ jobs:
           git init
           git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
-          git fetch --tags origin
           git checkout FETCH_HEAD
 
       - name: Build all platforms

.gitea/workflows/ci.yml.bak-20260123

@@ -1,75 +0,0 @@
-# Backup of .gitea/workflows/ci.yml — created before adding integration-verify-locks job
-# timestamp: 2026-01-23
-
-# CI/CD Pipeline for dbbackup (backup copy)
-# Source: .gitea/workflows/ci.yml
-# Created: 2026-01-23
-
-name: CI/CD
-
-on:
-  push:
-    branches: [main, master, develop]
-    tags: ['v*']
-  pull_request:
-    branches: [main, master]
-
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Run tests
-        run: go test -race -coverprofile=coverage.out ./...
-
-      - name: Coverage summary
-        run: go tool cover -func=coverage.out | tail -1
-
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Install and run golangci-lint
-        run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
-          golangci-lint run --timeout=5m ./...
-
-  build-and-release:
-    name: Build & Release
-    runs-on: ubuntu-latest
-    needs: [test, lint]
-    if: startsWith(github.ref, 'refs/tags/v')
-    container:
-      image: golang:1.24-bookworm
-    steps: |
-      <trimmed for backup>
-

.gitignore

@@ -12,21 +12,9 @@ logs/
 # Ignore built binaries (built fresh via build_all.sh on release)
 /dbbackup
 /dbbackup_*
-/dbbackup-*
 !dbbackup.png
-bin/
-
-# Ignore local configuration (may contain IPs/credentials)
-.dbbackup.conf
-
-# Ignore session/development notes
-TODO_SESSION.md
-QUICK.md
-QUICK_WINS.md
-
-# Ignore test backups
-test-backups/
-test-backups-*/
+bin/dbbackup_*
+bin/*.exe
 
 # Ignore development artifacts
 *.swp
@@ -50,21 +38,3 @@ CRITICAL_BUGS_FIXED.md
 LEGAL_DOCUMENTATION.md
 LEGAL_*.md
 legal/
-
-# Release binaries (uploaded via gh release, not git)
-release/dbbackup_*
-
-# Coverage output files
-*_cover.out
-
-# Audit and production reports (internal docs)
-EDGE_CASE_AUDIT_REPORT.md
-PRODUCTION_READINESS_AUDIT.md
-CRITICAL_BUGS_FIXED.md
-
-# Examples directory (if contains sensitive samples)
-examples/
-
-# Local database/test artifacts
-*.db
-*.sqlite

AZURE.md

@@ -236,8 +236,8 @@ dbbackup cloud download \
 # Manual delete
 dbbackup cloud delete "azure://prod-backups/postgres/old_backup.sql?account=myaccount&key=KEY"
 
-# Automatic cleanup (keep last 7 days, min 5 backups)
-dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=KEY" --retention-days 7 --min-backups 5
+# Automatic cleanup (keep last 7 backups)
+dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=KEY" --keep 7
 ```
 
 ### Scheduled Backups
@@ -253,7 +253,7 @@ dbbackup backup single production_db \
   --compression 9
 
 # Cleanup old backups
-dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=${AZURE_STORAGE_KEY}" --retention-days 30 --min-backups 5
+dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=${AZURE_STORAGE_KEY}" --keep 30
 ```
 
 **Crontab:**
@@ -385,7 +385,7 @@ Tests include:
 ### 4. Reliability
 
 - Test **restore procedures** regularly
-- Use **retention policies**: `--retention-days 30`
+- Use **retention policies**: `--keep 30`
 - Enable **soft delete** in Azure (30-day recovery)
 - Monitor backup success with Azure Monitor
 

CHANGELOG.md

@@ -5,1453 +5,6 @@ All notable changes to dbbackup will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [5.7.10] - 2026-02-03
-
-### Fixed
-- **TUI Auto-Select Index Mismatch**: Fixed `--tui-auto-select` case indices not matching keyboard handler
-  - Indices 5-11 were out of sync, causing wrong menu items to be selected in automated testing
-  - Added missing handlers for Schedule, Chain, and Profile commands
-- **TUI Back Navigation**: Fixed incorrect `tea.Quit` usage in done states
-  - `backup_exec.go` and `restore_exec.go` returned `tea.Quit` instead of `nil` for InterruptMsg
-  - This caused unwanted application exit instead of returning to parent menu
-- **TUI Separator Navigation**: Arrow keys now skip separator items
-  - Up/down navigation auto-skips items of kind `itemSeparator`
-  - Prevents cursor from landing on non-selectable menu separators
-- **TUI Input Validation**: Added ratio validation for percentage inputs
-  - Values outside 0-100 range now show error message
-  - Auto-confirm mode uses safe default (10) for invalid input
-
-### Added
-- **TUI Unit Tests**: 11 new tests + 2 benchmarks in `internal/tui/menu_test.go`
-  - Tests: navigation, quit, Ctrl+C, database switch, view rendering, auto-select
-  - Benchmarks: View rendering performance, navigation stress test
-- **TUI Smoke Test Script**: `tests/tui_smoke_test.sh` for CI/CD integration
-  - Tests all 19 menu items via `--tui-auto-select` flag
-  - No human input required, suitable for automated pipelines
-
-### Changed
-- **TUI TODO Messages**: Improved clarity with `[TODO]` prefix and version hints
-  - Placeholder items now show "[TODO] Feature Name - planned for v6.1"
-  - Added `warnStyle` for better visual distinction
-
-## [5.7.9] - 2026-02-03
-
-### Fixed
-- **Encryption Detection**: Fixed `IsBackupEncrypted()` not detecting single-database encrypted backups
-  - Was incorrectly treating single backups as cluster backups with empty database list
-  - Now properly checks `len(clusterMeta.Databases) > 0` before treating as cluster
-- **In-Place Decryption**: Fixed critical bug where in-place decryption corrupted files
-  - `DecryptFile()` with same input/output path would truncate file before reading
-  - Now uses temp file pattern for safe in-place decryption
-- **Metadata Update**: Fixed encryption metadata not being saved correctly
-  - `metadata.Load()` was called with wrong path (already had `.meta.json` suffix)
-
-### Tested
-- Full encryption round-trip: backup → encrypt → decrypt → restore (88 tables)
-- PostgreSQL DR Drill with `--no-owner --no-acl` flags
-- All 16+ core commands verified on dev.uuxo.net
-
-## [5.7.8] - 2026-02-03
-
-### Fixed
-- **DR Drill PostgreSQL**: Fixed restore failures on different host
-  - Added `--no-owner` and `--no-acl` flags to pg_restore
-  - Prevents role/permission errors when restoring to different PostgreSQL instance
-
-## [5.7.7] - 2026-02-03
-
-### Fixed
-- **DR Drill MariaDB**: Complete fixes for modern MariaDB containers
-  - Use TCP (127.0.0.1) instead of socket for health checks and restore
-  - Use `mariadb-admin` and `mariadb` client (not `mysqladmin`/`mysql`)
-  - Drop existing database before restore (backup contains CREATE DATABASE)
-  - Tested with MariaDB 12.1.2 image
-
-## [5.7.6] - 2026-02-03
-
-### Fixed
-- **Verify Command**: Fixed absolute path handling
-  - `dbbackup verify /full/path/to/backup.dump` now works correctly
-  - Previously always prefixed with `--backup-dir`, breaking absolute paths
-
-## [5.7.5] - 2026-02-03
-
-### Fixed
-- **SMTP Notifications**: Fixed false error on successful email delivery
-  - `client.Quit()` response "250 Ok: queued" was incorrectly treated as error
-  - Now properly closes data writer and ignores successful quit response
-
-## [5.7.4] - 2026-02-03
-
-### Fixed
-- **Notify Test Command** - Fixed `dbbackup notify test` to properly read NOTIFY_* environment variables
-  - Previously only checked `cfg.NotifyEnabled` which wasn't set from ENV
-  - Now uses `notify.ConfigFromEnv()` like the rest of the application
-  - Clear error messages showing exactly which ENV variables to set
-
-### Technical Details
-- `cmd/notify.go`: Refactored to use `notify.ConfigFromEnv()` instead of `cfg.*` fields
-
-## [5.7.3] - 2026-02-03
-
-### Fixed
-- **MariaDB Binlog Position Bug** - Fixed `getBinlogPosition()` to handle dynamic column count
-  - MariaDB `SHOW MASTER STATUS` returns 4 columns
-  - MySQL 5.6+ returns 5 columns (with `Executed_Gtid_Set`)
-  - Now tries 5 columns first, falls back to 4 columns for MariaDB compatibility
-
-### Improved
-- **Better `--password` Flag Error Message**
-  - Using `--password` now shows helpful error with instructions for `MYSQL_PWD`/`PGPASSWORD` environment variables
-  - Flag is hidden but accepted for better error handling
-
-- **Improved Fallback Logging for PostgreSQL Peer Authentication**
-  - Changed from `WARN: Native engine failed, falling back...` 
-  - Now shows `INFO: Native engine requires password auth, using pg_dump with peer authentication`
-  - Clearer indication that this is expected behavior, not an error
-
-- **Reduced Noise from Binlog Position Warnings**
-  - "Binary logging not enabled" now logged at DEBUG level (was WARN)
-  - "Insufficient privileges for binlog" now logged at DEBUG level (was WARN)
-  - Only unexpected errors still logged as WARN
-
-### Technical Details
-- `internal/engine/native/mysql.go`: Dynamic column detection in `getBinlogPosition()`
-- `cmd/root.go`: Added hidden `--password` flag with helpful error message
-- `cmd/backup_impl.go`: Improved fallback logging for peer auth scenarios
-
-## [5.7.2] - 2026-02-02
-
-### Added
-- Native engine improvements for production stability
-
-## [5.7.1] - 2026-02-02
-
-### Fixed
-- Minor stability fixes
-
-## [5.7.0] - 2026-02-02
-
-### Added
-- Enhanced native engine support for MariaDB
-
-## [5.6.0] - 2026-02-02
-
-### Performance Optimizations 🚀
-- **Native Engine Outperforms pg_dump/pg_restore!**
-  - Backup: **3.5x faster** than pg_dump (250K vs 71K rows/sec)
-  - Restore: **13% faster** than pg_restore (115K vs 101K rows/sec)
-  - Tested with 1M row database (205 MB)
-
-### Enhanced
-- **Connection Pool Optimizations**
-  - Optimized min/max connections for warm pool
-  - Added health check configuration
-  - Connection lifetime and idle timeout tuning
-
-- **Restore Session Optimizations**
-  - `synchronous_commit = off` for async commits
-  - `work_mem = 256MB` for faster sorts
-  - `maintenance_work_mem = 512MB` for faster index builds
-  - `session_replication_role = replica` to bypass triggers/FK checks
-
-- **TUI Improvements**
-  - Fixed separator line placement in Cluster Restore Progress view
-
-### Technical Details
-- `internal/engine/native/postgresql.go`: Pool optimization with min/max connections
-- `internal/engine/native/restore.go`: Session-level performance settings
-
-## [5.5.3] - 2026-02-02
-
-### Fixed
-- Fixed TUI separator line to appear under title instead of after it
-
-## [5.5.2] - 2026-02-02
-
-### Fixed
-- **CRITICAL: Native Engine Array Type Support**
-  - Fixed: Array columns (e.g., `INTEGER[]`, `TEXT[]`) were exported as just `ARRAY`
-  - Now properly exports array types using PostgreSQL's `udt_name` from information_schema
-  - Supports all common array types: integer[], text[], bigint[], boolean[], bytea[], json[], jsonb[], uuid[], timestamp[], etc.
-
-### Verified Working
-- **Full BLOB/Binary Data Round-Trip Validated**
-  - BYTEA columns with NULL bytes (0x00) preserved correctly
-  - Unicode data (emoji 🚀, Chinese 中文, Arabic العربية) preserved
-  - JSON/JSONB with Unicode preserved
-  - Integer and text arrays restored correctly
-  - 10,002 row test with checksum verification: PASS
-
-### Technical Details
-- `internal/engine/native/postgresql.go`: 
-  - Added `udt_name` to column query
-  - Updated `formatDataType()` to convert PostgreSQL internal array names (_int4, _text, etc.) to SQL syntax
-
-## [5.5.1] - 2026-02-02
-
-### Fixed
-- **CRITICAL: Native Engine Restore Fixed** - Restore now connects to target database correctly
-  - Previously connected to source database, causing data to be written to wrong database
-  - Now creates engine with target database for proper restore
-
-- **CRITICAL: Native Engine Backup - Sequences Now Exported**
-  - Fixed: Sequences were silently skipped due to type mismatch in PostgreSQL query
-  - Cast `information_schema.sequences` string values to bigint
-  - Sequences now properly created BEFORE tables that reference them
-
-- **CRITICAL: Native Engine COPY Handling**
-  - Fixed: COPY FROM stdin data blocks now properly parsed and executed
-  - Replaced simple line-by-line SQL execution with proper COPY protocol handling
-  - Uses pgx `CopyFrom` for bulk data loading (100k+ rows/sec)
-
-- **Tool Verification Bypass for Native Mode**
-  - Skip pg_restore/psql check when `--native` flag is used
-  - Enables truly zero-dependency deployment
-
-- **Panic Fix: Slice Bounds Error**
-  - Fixed runtime panic when logging short SQL statements during errors
-
-### Technical Details
-- `internal/engine/native/manager.go`: Create new engine with target database for restore
-- `internal/engine/native/postgresql.go`: Fixed Restore() to handle COPY protocol, fixed getSequenceCreateSQL() type casting
-- `cmd/restore.go`: Skip VerifyTools when cfg.UseNativeEngine is true
-- `internal/tui/restore_preview.go`: Show "Native engine mode" instead of tool check
-
-## [5.5.0] - 2026-02-02
-
-### Added
-- **🚀 Native Engine Support for Cluster Backup/Restore**
-  - NEW: `--native` flag for cluster backup creates SQL format (.sql.gz) using pure Go
-  - NEW: `--native` flag for cluster restore uses pure Go engine for .sql.gz files
-  - Zero external tool dependencies when using native mode
-  - Single-binary deployment now possible without pg_dump/pg_restore installed
-  
-- **Native Cluster Backup** (`dbbackup backup cluster --native`)
-  - Creates .sql.gz files instead of .dump files
-  - Uses pgx wire protocol for data export
-  - Parallel gzip compression with pgzip
-  - Automatic fallback to pg_dump if `--fallback-tools` is set
-  
-- **Native Cluster Restore** (`dbbackup restore cluster --native --confirm`)
-  - Restores .sql.gz files using pure Go (pgx CopyFrom)
-  - No psql or pg_restore required
-  - Automatic detection: uses native for .sql.gz, pg_restore for .dump
-  - Fallback support with `--fallback-tools`
-
-### Updated
-- **NATIVE_ENGINE_SUMMARY.md** - Complete rewrite with accurate documentation
-- Native engine matrix now shows full cluster support with `--native` flag
-
-### Technical Details
-- `internal/backup/engine.go`: Added native engine path in BackupCluster()
-- `internal/restore/engine.go`: Added `restoreWithNativeEngine()` function
-- `cmd/backup.go`: Added `--native` and `--fallback-tools` flags to cluster command
-- `cmd/restore.go`: Added `--native` and `--fallback-tools` flags with PreRunE handlers
-- Version bumped to 5.5.0 (new feature release)
-
-## [5.4.6] - 2026-02-02
-
-### Fixed
-- **CRITICAL: Progress Tracking for Large Database Restores**
-  - Fixed "no progress" issue where TUI showed 0% for hours during large single-DB restore
-  - Root cause: Progress only updated after database *completed*, not during restore
-  - Heartbeat now reports estimated progress every 5 seconds (was 15s, text-only)
-  - Time-based progress estimation: ~10MB/s throughput assumption
-  - Progress capped at 95% until actual completion (prevents jumping to 100% too early)
-  
-- **Improved TUI Feedback During Long Restores**
-  - Shows spinner + elapsed time when byte-level progress not available
-  - Displays "pg_restore in progress (progress updates every 5s)" message
-  - Better visual feedback that restore is actively running
-
-### Technical Details
-- `reportDatabaseProgressByBytes()` now called during restore, not just after completion
-- Heartbeat interval reduced from 15s to 5s for more responsive feedback
-- TUI gracefully handles `CurrentDBTotal=0` case with activity indicator
-
-## [5.4.5] - 2026-02-02
-
-### Fixed
-- **Accurate Disk Space Estimation for Cluster Archives**
-  - Fixed WARNING showing 836GB for 119GB archive - was using wrong compression multiplier
-  - Cluster archives (.tar.gz) contain pre-compressed .dump files → now uses 1.2x multiplier
-  - Single SQL files (.sql.gz) still use 5x multiplier (was 7x, slightly optimized)
-  - New `CheckSystemMemoryWithType(size, isClusterArchive)` method for accurate estimates
-  - 119GB cluster archive now correctly estimates ~143GB instead of ~833GB
-
-## [5.4.4] - 2026-02-02
-
-### Fixed
-- **TUI Header Separator Fix** - Capped separator length at 40 chars to prevent line overflow on wide terminals
-
-## [5.4.3] - 2026-02-02
-
-### Fixed
-- **Bulletproof SIGINT Handling** - Zero zombie processes guaranteed
-  - All external commands now use `cleanup.SafeCommand()` with process group isolation
-  - `KillCommandGroup()` sends signals to entire process group (-pgid)
-  - No more orphaned pg_restore/pg_dump/psql/pigz processes on Ctrl+C
-  - 16 files updated with proper signal handling
-
-- **Eliminated External gzip Process** - The `zgrep` command was spawning `gzip -cdfq`
-  - Replaced with in-process pgzip decompression in `preflight.go`
-  - `estimateBlobsInSQL()` now uses pure Go pgzip.NewReader
-  - Zero external gzip processes during restore
-
-## [5.1.22] - 2026-02-01
-
-### Added
-- **Restore Metrics for Prometheus/Grafana** - Now you can monitor restore performance!
-  - `dbbackup_restore_total{status="success|failure"}` - Total restore count
-  - `dbbackup_restore_duration_seconds{profile, parallel_jobs}` - Restore duration
-  - `dbbackup_restore_parallel_jobs{profile}` - Jobs used (shows if turbo=8 is working!)
-  - `dbbackup_restore_size_bytes` - Restored archive size
-  - `dbbackup_restore_last_timestamp` - Last restore time
-  
-- **Grafana Dashboard: Restore Operations Section**
-  - Total Successful/Failed Restores
-  - Parallel Jobs Used (RED if 1=SLOW, GREEN if 8=TURBO)
-  - Last Restore Duration with thresholds
-  - Restore Duration Over Time graph
-  - Parallel Jobs per Restore bar chart
-
-- **Restore Engine Metrics Recording**
-  - All single database and cluster restores now record metrics
-  - Stored in `~/.dbbackup/restore_metrics.json`
-  - Prometheus exporter reads and exposes these metrics
-
-## [5.1.21] - 2026-02-01
-
-### Fixed
-- **Complete verification of profile system** - Full code path analysis confirms TURBO works:
-  - CLI: `--profile turbo` → `config.ApplyProfile()` → `cfg.Jobs=8` → `pg_restore --jobs=8`
-  - TUI: Settings → `ApplyResourceProfile()` → `cpu.GetProfileByName("turbo")` → `cfg.Jobs=8`
-  - Updated help text for `restore cluster` command to show turbo example
-  - Updated flag description to list all profiles: conservative, balanced, turbo, max-performance
-
-## [5.1.20] - 2026-02-01
-
-### Fixed
-- **CRITICAL: "turbo" and "max-performance" profiles were NOT recognized in restore command!**
-  - `profile.go` only had: conservative, balanced, aggressive, potato
-  - "turbo" profile returned ERROR "unknown profile" and SILENTLY fell back to "balanced"
-  - "balanced" profile has `Jobs: 0` which became `Jobs: 1` after default fallback
-  - **Result: --profile turbo was IGNORED and restore ran with --jobs=1 (single-threaded)**
-  - Added turbo profile: Jobs=8, ParallelDBs=2
-  - Added max-performance profile: Jobs=8, ParallelDBs=4
-  - NOW `--profile turbo` correctly uses `pg_restore --jobs=8`
-
-## [5.1.19] - 2026-02-01
-
-### Fixed
-- **CRITICAL: pg_restore --jobs flag was NEVER added when Parallel <= 1** - Root cause finally found and fixed:
-  - In `BuildRestoreCommand()` the condition was `if options.Parallel > 1` which meant `--jobs` flag was NEVER added when Parallel was 1 or less
-  - Changed to `if options.Parallel > 0` so `--jobs` is ALWAYS set when Parallel > 0
-  - This was THE root cause why restores took 12+ hours instead of ~4 hours
-  - Now `pg_restore --jobs=8` is correctly generated for turbo profile
-
-## [5.1.18] - 2026-02-01
-
-### Fixed
-- **CRITICAL: Profile Jobs setting now ALWAYS respected** - Removed multiple code paths that were overriding user's profile Jobs setting:
-  - `restoreSection()` for phased restores now uses `--jobs` flag (was missing entirely!)
-  - Removed auto-fallback that forced `Jobs=1` when PostgreSQL locks couldn't be boosted
-  - Removed auto-fallback that forced `Jobs=1` on low memory detection
-  - User's profile choice (turbo, performance, etc.) is now respected - only warnings are logged
-  - This was causing restores to take 9+ hours instead of ~4 hours with turbo profile
-
-## [5.1.17] - 2026-02-01
-
-### Fixed
-- **TUI Settings now persist to disk** - Settings changes in TUI are now saved to `.dbbackup.conf` file, not just in-memory
-- **Native Engine is now the default** - Pure Go engine (no external tools required) is now the default instead of external tools mode
-
-## [5.1.16] - 2026-02-01
-
-### Fixed
-- **Critical: pg_restore parallel jobs now actually used** - Fixed bug where `--jobs` flag and profile `Jobs` setting were completely ignored for `pg_restore`. The code had hardcoded `Parallel: 1` instead of using `e.cfg.Jobs`, causing all restores to run single-threaded regardless of configuration. This fix enables 3-4x faster restores matching native `pg_restore -j8` performance.
-  - Affected functions: `restorePostgreSQLDump()`, `restorePostgreSQLDumpWithOwnership()`
-  - Now logs `parallel_jobs` value for visibility
-  - Turbo profile with `Jobs: 8` now correctly passes `--jobs=8` to pg_restore
-
-## [5.1.15] - 2026-01-31
-
-### Fixed
-- Fixed go vet warning for Printf directive in shell command output (CI fix)
-
-## [5.1.14] - 2026-01-31
-
-### Added - Quick Win Features
-
-- **Cross-Region Sync** (`cloud cross-region-sync`)
-  - Sync backups between cloud regions for disaster recovery
-  - Support for S3, MinIO, Azure Blob, Google Cloud Storage
-  - Parallel transfers with configurable concurrency
-  - Dry-run mode to preview sync plan
-  - Filter by database name or backup age
-  - Delete orphaned files with `--delete` flag
-
-- **Retention Policy Simulator** (`retention-simulator`)
-  - Preview retention policy effects without deleting backups
-  - Simulate simple age-based and GFS retention strategies
-  - Compare multiple retention periods side-by-side (7, 14, 30, 60, 90 days)
-  - Calculate space savings and backup counts
-  - Analyze backup frequency and provide recommendations
-
-- **Catalog Dashboard** (`catalog dashboard`)
-  - Interactive TUI for browsing backup catalog
-  - Sort by date, size, database, or type
-  - Filter backups with search
-  - Detailed view with backup metadata
-  - Keyboard navigation (vim-style keys supported)
-
-- **Parallel Restore Analysis** (`parallel-restore`)
-  - Analyze system for optimal parallel restore settings
-  - Benchmark disk I/O performance
-  - Simulate restore with different parallelism levels
-  - Provide recommendations based on CPU and memory
-
-- **Progress Webhooks** (`progress-webhooks`)
-  - Configure webhook notifications for backup/restore progress
-  - Periodic progress updates during long operations
-  - Test mode to verify webhook connectivity
-  - Environment variable configuration (DBBACKUP_WEBHOOK_URL)
-
-- **Encryption Key Rotation** (`encryption rotate`)
-  - Generate new encryption keys (128, 192, 256-bit)
-  - Save keys to file with secure permissions (0600)
-  - Support for base64 and hex output formats
-
-### Changed
-- Updated version to 5.1.14
-- Removed development files from repository (.dbbackup.conf, TODO_SESSION.md, test-backups/)
-
-## [5.1.0] - 2026-01-30
-
-### Fixed
-- **CRITICAL**: Fixed PostgreSQL native engine connection pooling issues that caused \"conn busy\" errors
-- **CRITICAL**: Fixed PostgreSQL table data export - now properly captures all table schemas and data using COPY protocol
-- **CRITICAL**: Fixed PostgreSQL native engine to use connection pool for all metadata queries (getTables, getViews, getSequences, getFunctions)
-- Fixed gzip compression implementation in native backup CLI integration
-- Fixed exitcode package syntax errors causing CI failures
-
-### Added
-- Enhanced PostgreSQL native engine with proper connection pool management
-- Complete table data export using COPY TO STDOUT protocol
-- Comprehensive testing with complex data types (JSONB, arrays, foreign keys)
-- Production-ready native engine performance and stability
-
-### Changed
-- All PostgreSQL metadata queries now use connection pooling instead of shared connection
-- Improved error handling and debugging output for native engines
-- Enhanced backup file structure with proper SQL headers and footers
-
-## [5.0.1] - 2026-01-30
-
-### Fixed - Quality Improvements
-
-- **PostgreSQL COPY Format**: Fixed format mismatch - now uses native TEXT format compatible with `COPY FROM stdin`
-- **MySQL Restore Security**: Fixed potential SQL injection in restore by properly escaping backticks in database names
-- **MySQL 8.0.22+ Compatibility**: Added fallback for `SHOW BINARY LOG STATUS` (MySQL 8.0.22+) with graceful fallback to `SHOW MASTER STATUS` for older versions
-- **Duration Calculation**: Fixed backup duration tracking to accurately capture elapsed time
-
----
-
-## [5.0.0] - 2026-01-30
-
-### MAJOR RELEASE - Native Engine Implementation
-
-**BREAKTHROUGH: We Built Our Own Database Engines**
-
-**This is a really big step.** We're no longer calling external tools - **we built our own machines**.
-
-dbbackup v5.0.0 represents a **fundamental architectural revolution**. We've eliminated ALL external tool dependencies by implementing pure Go database engines that speak directly to PostgreSQL and MySQL using their native wire protocols. No more pg_dump. No more mysqldump. No more shelling out. **Our code, our engines, our control.**
-
-### Added - Native Database Engines
-
-- **Native PostgreSQL Engine (`internal/engine/native/postgresql.go`)**
-  - Pure Go implementation using pgx/v5 driver
-  - Direct PostgreSQL wire protocol communication
-  - Native SQL generation and COPY data export
-  - Advanced data type handling (arrays, JSON, binary, timestamps)
-  - Proper SQL escaping and PostgreSQL-specific formatting
-
-- **Native MySQL Engine (`internal/engine/native/mysql.go`)**
-  - Pure Go implementation using go-sql-driver/mysql
-  - Direct MySQL protocol communication
-  - Batch INSERT generation with advanced data types
-  - Binary data support with hex encoding
-  - MySQL-specific escape sequences and formatting
-
-- **Advanced Engine Framework (`internal/engine/native/advanced.go`)**
-  - Extensible architecture for multiple backup formats
-  - Compression support (Gzip, Zstd, LZ4)
-  - Configurable batch processing (1K-10K rows per batch)
-  - Performance optimization settings
-  - Future-ready for custom formats and parallel processing
-
-- **Engine Manager (`internal/engine/native/manager.go`)**
-  - Pluggable architecture for engine selection
-  - Configuration-based engine initialization
-  - Unified backup orchestration across all engines
-  - Automatic fallback mechanisms
-
-- **Restore Framework (`internal/engine/native/restore.go`)**
-  - Native restore engine architecture (basic implementation)
-  - Transaction control and error handling
-  - Progress tracking and status reporting
-  - Foundation for complete restore implementation
-
-### Added - CLI Integration
-
-- **New Command Line Flags**
-  - `--native`: Use pure Go native engines (no external tools)
-  - `--fallback-tools`: Fallback to external tools if native engine fails
-  - `--native-debug`: Enable detailed native engine debugging
-
-### Added - Advanced Features
-
-- **Production-Ready Data Handling**
-  - Proper handling of complex PostgreSQL types (arrays, JSON, custom types)
-  - Advanced MySQL binary data encoding and type detection
-  - NULL value handling across all data types
-  - Timestamp formatting with microsecond precision
-  - Memory-efficient streaming for large datasets
-
-- **Performance Optimizations**
-  - Configurable batch processing for optimal throughput
-  - I/O streaming with buffered writers
-  - Connection pooling integration
-  - Memory usage optimization for large tables
-
-### Changed - Core Architecture
-
-- **Zero External Dependencies**: No longer requires pg_dump, mysqldump, pg_restore, mysql, psql, or mysqlbinlog
-- **Native Protocol Communication**: Direct database protocol usage instead of shelling out to external tools
-- **Pure Go Implementation**: All backup and restore operations now implemented in Go
-- **Backward Compatibility**: All existing configurations and workflows continue to work
-
-### Technical Impact
-
-- **Build Size**: Reduced dependencies and smaller binaries
-- **Performance**: Eliminated process spawning overhead and improved data streaming
-- **Reliability**: Removed external tool version compatibility issues
-- **Maintenance**: Simplified deployment with single binary distribution
-- **Security**: Eliminated attack vectors from external tool dependencies
-
-### Migration Guide
-
-Existing users can continue using dbbackup exactly as before - all existing configurations work unchanged. The new native engines are opt-in via the `--native` flag.
-
-**Recommended**: Test native engines with `--native --native-debug` flags, then switch to native-only operation for improved performance and reliability.
-
----
-
-## [4.2.9] - 2026-01-30
-
-### Added - MEDIUM Priority Features
-
-- **#11: Enhanced Error Diagnostics with System Context (MEDIUM priority)**
-  - Automatic environmental context collection on errors
-  - Real-time system diagnostics: disk space, memory, file descriptors
-  - PostgreSQL diagnostics: connections, locks, shared memory, version
-  - Smart root cause analysis based on error + environment
-  - Context-specific recommendations (e.g., "Disk 95% full" → cleanup commands)
-  - Comprehensive diagnostics report with actionable fixes
-  - **Problem**: Errors showed symptoms but not environmental causes
-  - **Solution**: Diagnose system state + error pattern → root cause + fix
-
-**Diagnostic Report Includes:**
-- Disk space usage and available capacity
-- Memory usage and pressure indicators
-- File descriptor utilization (Linux/Unix)
-- PostgreSQL connection pool status
-- Lock table capacity calculations
-- Version compatibility checks
-- Contextual recommendations based on actual system state
-
-**Example Diagnostics:**
-```
-═══════════════════════════════════════════════════════════
-  DBBACKUP ERROR DIAGNOSTICS REPORT
-═══════════════════════════════════════════════════════════
-
-Error Type: CRITICAL
-Category:   locks
-Severity:   2/3
-
-Message:
-  out of shared memory: max_locks_per_transaction exceeded
-
-Root Cause:
-  Lock table capacity too low (32,000 total locks). Likely cause: 
-  max_locks_per_transaction (128) too low for this database size
-
-System Context:
-  Disk Space:  45.3 GB / 100.0 GB (45.3% used)
-  Memory:      3.2 GB / 8.0 GB (40.0% used)
-  File Descriptors: 234 / 4096
-
-Database Context:
-  Version:     PostgreSQL 14.10
-  Connections: 15 / 100
-  Max Locks:   128 per transaction
-  Total Lock Capacity: ~12,800
-
-Recommendations:
-  Current lock capacity: 12,800 locks (max_locks_per_transaction × max_connections)
-  WARNING: max_locks_per_transaction is low (128)
-  • Increase: ALTER SYSTEM SET max_locks_per_transaction = 4096;
-  • Then restart PostgreSQL: sudo systemctl restart postgresql
-
-Suggested Action:
-  Fix: ALTER SYSTEM SET max_locks_per_transaction = 4096; then 
-  RESTART PostgreSQL
-```
-
-**Functions:**
-- `GatherErrorContext()` - Collects system + database metrics
-- `DiagnoseError()` - Full error analysis with environmental context
-- `FormatDiagnosticsReport()` - Human-readable report generation
-- `generateContextualRecommendations()` - Smart recommendations based on state
-- `analyzeRootCause()` - Pattern matching for root cause identification
-
-**Integration:**
-- Available for all backup/restore operations
-- Automatic context collection on critical errors
-- Can be manually triggered for troubleshooting
-- Export as JSON for automated monitoring
-
-## [4.2.8] - 2026-01-30
-
-### Added - MEDIUM Priority Features
-
-- **#10: WAL Archive Statistics (MEDIUM priority)**
-  - `dbbackup pitr status` now shows comprehensive WAL archive statistics
-  - Displays: total files, total size, compression rate, oldest/newest WAL, time span
-  - Auto-detects archive directory from PostgreSQL `archive_command`
-  - Supports compressed (.gz, .zst, .lz4) and encrypted (.enc) WAL files
-  - **Problem**: No visibility into WAL archive health and growth
-  - **Solution**: Real-time stats in PITR status command, helps identify retention issues
-
-**Example Output:**
-```
-WAL Archive Statistics:
-======================================================
-  Total Files:      1,234
-  Total Size:       19.8 GB
-  Average Size:     16.4 MB
-  Compressed:       1,234 files (68.5% saved)
-  Encrypted:        1,234 files
-
-  Oldest WAL:       000000010000000000000042
-    Created:        2026-01-15 08:30:00
-  Newest WAL:       000000010000000000004D2F
-    Created:        2026-01-30 17:45:30
-  Time Span:        15.4 days
-```
-
-**Files Modified:**
-- `internal/wal/archiver.go`: Extended `ArchiveStats` struct with detailed fields
-- `internal/wal/archiver.go`: Added `GetArchiveStats()`, `FormatArchiveStats()` functions
-- `cmd/pitr.go`: Integrated stats into `pitr status` command
-- `cmd/pitr.go`: Added `extractArchiveDirFromCommand()` helper
-
-## [4.2.7] - 2026-01-30
-
-### Added - HIGH Priority Features
-
-- **#9: Auto Backup Verification (HIGH priority)**
-  - Automatic integrity verification after every backup (default: ON)
-  - Single DB backups: Full SHA-256 checksum verification
-  - Cluster backups: Quick tar.gz structure validation (header scan)
-  - Prevents corrupted backups from being stored undetected
-  - Can disable with `--no-verify` flag or `VERIFY_AFTER_BACKUP=false`
-  - Performance overhead: +5-10% for single DB, +1-2% for cluster
-  - **Problem**: Backups not verified until restore time (too late to fix)
-  - **Solution**: Immediate feedback on backup integrity, fail-fast on corruption
-
-### Fixed - Performance & Reliability
-
-- **#5: TUI Memory Leak in Long Operations (HIGH priority)**
-  - Throttled progress speed samples to max 10 updates/second (100ms intervals)
-  - Fixed memory bloat during large cluster restores (100+ databases)
-  - Reduced memory usage by ~90% in long-running operations
-  - No visual degradation (10 FPS is smooth enough for progress display)
-  - Applied to: `internal/tui/restore_exec.go`, `internal/tui/detailed_progress.go`
-  - **Problem**: Progress callbacks fired on every 4KB buffer read = millions of allocations
-  - **Solution**: Throttle sample collection to prevent unbounded array growth
-
-## [4.2.5] - 2026-01-30
-## [4.2.6] - 2026-01-30
-
-### Security - Critical Fixes
-
-- **SEC#1: Password exposure in process list**
-  - Removed `--password` CLI flag to prevent passwords appearing in `ps aux`
-  - Use environment variables (`PGPASSWORD`, `MYSQL_PWD`) or config file instead
-  - Enhanced security for multi-user systems and shared environments
-
-- **SEC#2: World-readable backup files**
-  - All backup files now created with 0600 permissions (owner-only read/write)
-  - Prevents unauthorized users from reading sensitive database dumps
-  - Affects: `internal/backup/engine.go`, `incremental_mysql.go`, `incremental_tar.go`
-  - Critical for GDPR, HIPAA, and PCI-DSS compliance
-
-- **#4: Directory race condition in parallel backups**
-  - Replaced `os.MkdirAll()` with `fs.SecureMkdirAll()` that handles EEXIST gracefully
-  - Prevents "file exists" errors when multiple backup processes create directories
-  - Affects: All backup directory creation paths
-
-### Added
-
-- **internal/fs/secure.go**: New secure file operations utilities
-  - `SecureMkdirAll()`: Race-condition-safe directory creation
-  - `SecureCreate()`: File creation with 0600 permissions
-  - `SecureMkdirTemp()`: Temporary directories with 0700 permissions
-  - `CheckWriteAccess()`: Proactive detection of read-only filesystems
-
-- **internal/exitcode/codes.go**: BSD-style exit codes for automation
-  - Standard exit codes for scripting and monitoring systems
-  - Improves integration with systemd, cron, and orchestration tools
-
-### Fixed
-
-- Fixed multiple file creation calls using insecure 0644 permissions
-- Fixed race conditions in backup directory creation during parallel operations
-- Improved security posture for multi-user and shared environments
-
-
-### Fixed - TUI Cluster Restore Double-Extraction
-
-- **TUI cluster restore performance optimization**
-  - Eliminated double-extraction: cluster archives were scanned twice (once for DB list, once for restore)
-  - `internal/restore/extract.go`: Added `ListDatabasesFromExtractedDir()` to list databases from disk instead of tar scan
-  - `internal/tui/cluster_db_selector.go`: Now pre-extracts cluster once, lists from extracted directory
-  - `internal/tui/archive_browser.go`: Added `ExtractedDir` field to `ArchiveInfo` for passing pre-extracted path
-  - `internal/tui/restore_exec.go`: Reuses pre-extracted directory when available
-  - **Performance improvement:** 50GB cluster archive now processes once instead of twice (saves 5-15 minutes)
-  - Automatic cleanup of extracted directory after restore completes or fails
-
-## [4.2.4] - 2026-01-30
-
-### Fixed - Comprehensive Ctrl+C Support Across All Operations
-
-- **System-wide context-aware file operations**
-  - All long-running I/O operations now respond to Ctrl+C
-  - Added `CopyWithContext()` to cloud package for S3/Azure/GCS transfers
-  - Partial files are cleaned up on cancellation
-
-- **Fixed components:**
-  - `internal/restore/extract.go`: Single DB extraction from cluster
-  - `internal/wal/compression.go`: WAL file compression/decompression
-  - `internal/restore/engine.go`: SQL restore streaming (2 paths)
-  - `internal/backup/engine.go`: pg_dump/mysqldump streaming (3 paths)
-  - `internal/cloud/s3.go`: S3 download interruption
-  - `internal/cloud/azure.go`: Azure Blob download interruption
-  - `internal/cloud/gcs.go`: GCS upload/download interruption
-  - `internal/drill/engine.go`: DR drill decompression
-
-## [4.2.3] - 2026-01-30
-
-### Fixed - Cluster Restore Performance & Ctrl+C Handling
-
-- **Removed redundant gzip validation in cluster restore**
-  - `ValidateAndExtractCluster()` no longer calls `ValidateArchive()` internally
-  - Previously validation happened 2x before extraction (caller + internal)
-  - Eliminates duplicate gzip header reads on large archives
-  - Reduces cluster restore startup time
-
-- **Fixed Ctrl+C not working during extraction**
-  - Added `CopyWithContext()` function for context-aware file copying
-  - Extraction now checks for cancellation every 1MB of data
-  - Ctrl+C immediately interrupts large file extractions
-  - Partial files are cleaned up on cancellation
-  - Applies to both `ExtractTarGzParallel` and `extractArchiveWithProgress`
-
-## [4.2.2] - 2026-01-30
-
-### Fixed - Complete pgzip Migration (Backup Side)
-
-- **Removed ALL external gzip/pigz calls from backup engine**
-  - `internal/backup/engine.go`: `executeWithStreamingCompression` now uses pgzip
-  - `internal/parallel/engine.go`: Fixed stub gzipWriter to use pgzip
-  - No more gzip/pigz processes visible in htop during backup
-  - Uses klauspost/pgzip for parallel multi-core compression
-
-- **Complete pgzip migration status**:
-  - Backup: All compression uses in-process pgzip
-  - Restore: All decompression uses in-process pgzip  
-  - Drill: Decompress on host with pgzip before Docker copy
-  - WARNING: PITR only: PostgreSQL's `restore_command` must remain shell (PostgreSQL limitation)
-
-## [4.2.1] - 2026-01-30
-
-### Fixed - Complete pgzip Migration
-
-- **Removed ALL external gunzip/gzip calls** - Systematic audit and fix
-  - `internal/restore/engine.go`: SQL restores now use pgzip stream → psql/mysql stdin
-  - `internal/drill/engine.go`: Decompress on host with pgzip before Docker copy
-  - No more gzip/gunzip/pigz processes visible in htop during restore
-  - Uses klauspost/pgzip for parallel multi-core decompression
-
-- **PostgreSQL PITR exception** - `restore_command` in recovery config must remain shell
-  - PostgreSQL itself runs this command to fetch WAL files
-  - Cannot be replaced with Go code (PostgreSQL limitation)
-
-## [4.2.0] - 2026-01-30
-
-### Added - Quick Wins Release
-
-- **`dbbackup health` command** - Comprehensive backup infrastructure health check
-  - 10 automated health checks: config, DB connectivity, backup dir, catalog, freshness, gaps, verification, file integrity, orphans, disk space
-  - Exit codes for automation: 0=healthy, 1=warning, 2=critical
-  - JSON output for monitoring integration (Prometheus, Nagios, etc.)
-  - Auto-generates actionable recommendations
-  - Custom backup interval for gap detection: `--interval 12h`
-  - Skip database check for offline mode: `--skip-db`
-  - Example: `dbbackup health --format json`
-
-- **TUI System Health Check** - Interactive health monitoring
-  - Accessible via Tools → System Health Check
-  - Runs all 10 checks asynchronously with progress spinner
-  - Color-coded results: green=healthy, yellow=warning, red=critical
-  - Displays recommendations for any issues found
-
-- **`dbbackup restore preview` command** - Pre-restore analysis and validation
-  - Shows backup format, compression type, database type
-  - Estimates uncompressed size (3x compression ratio)
-  - Calculates RTO (Recovery Time Objective) based on active profile
-  - Validates backup integrity without actual restore
-  - Displays resource requirements (RAM, CPU, disk space)
-  - Example: `dbbackup restore preview backup.dump.gz`
-
-- **`dbbackup diff` command** - Compare two backups and track changes
-  - Flexible input: file paths, catalog IDs, or `database:latest/previous`
-  - Shows size delta with percentage change
-  - Calculates database growth rate (GB/day)
-  - Projects time to reach 10GB threshold
-  - Compares backup duration and compression efficiency
-  - JSON output for automation and reporting
-  - Example: `dbbackup diff mydb:latest mydb:previous`
-
-- **`dbbackup cost analyze` command** - Cloud storage cost optimization
-  - Analyzes 15 storage tiers across 5 cloud providers
-  - AWS S3: Standard, IA, Glacier Instant/Flexible, Deep Archive
-  - Google Cloud Storage: Standard, Nearline, Coldline, Archive
-  - Azure Blob Storage: Hot, Cool, Archive
-  - Backblaze B2 and Wasabi alternatives
-  - Monthly/annual cost projections
-  - Savings calculations vs S3 Standard baseline
-  - Tiered lifecycle strategy recommendations
-  - Shows potential savings of 90%+ with proper policies
-  - Example: `dbbackup cost analyze --database mydb`
-
-### Enhanced
-- **TUI restore preview** - Added RTO estimates and size calculations
-  - Shows estimated uncompressed size during restore confirmation
-  - Displays estimated restore time based on current profile
-  - Helps users make informed restore decisions
-  - Keeps TUI simple (essentials only), detailed analysis in CLI
-
-### Documentation
-- Updated README.md with new commands and examples
-- Created QUICK_WINS.md documenting the rapid development sprint
-- Added backup diff and cost analysis sections
-
-## [4.1.4] - 2026-01-29
-
-### Added
-- **New `turbo` restore profile** - Maximum restore speed, matches native `pg_restore -j8`
-  - `ClusterParallelism = 2` (restore 2 DBs concurrently)
-  - `Jobs = 8` (8 parallel pg_restore jobs)
-  - `BufferedIO = true` (32KB write buffers for faster extraction)
-  - Works on 16GB+ RAM, 4+ cores
-  - Usage: `dbbackup restore cluster backup.tar.gz --profile=turbo --confirm`
-
-- **Restore startup performance logging** - Shows actual parallelism settings at restore start
-  - Logs profile name, cluster_parallelism, pg_restore_jobs, buffered_io
-  - Helps verify settings before long restore operations
-
-- **Buffered I/O optimization** - 32KB write buffers during tar extraction (turbo profile)
-  - Reduces system call overhead
-  - Improves I/O throughput for large archives
-
-### Fixed
-- **TUI now respects saved profile settings** - Previously TUI forced `conservative` profile on every launch, ignoring user's saved configuration. Now properly loads and respects saved settings.
-
-### Changed
-- TUI default profile changed from forced `conservative` to `balanced` (only when no profile configured)
-- `LargeDBMode` no longer forced on TUI startup - user controls it via settings
-
-## [4.1.3] - 2026-01-27
-
-### Added
-- **`--config` / `-c` global flag** - Specify config file path from anywhere
-  - Example: `dbbackup --config /opt/dbbackup/.dbbackup.conf backup single mydb`
-  - No longer need to `cd` to config directory before running commands
-  - Works with all subcommands (backup, restore, verify, etc.)
-
-## [4.1.2] - 2026-01-27
-
-### Added
-- **`--socket` flag for MySQL/MariaDB** - Connect via Unix socket instead of TCP/IP
-  - Usage: `dbbackup backup single mydb --db-type mysql --socket /var/run/mysqld/mysqld.sock`
-  - Works for both backup and restore operations
-  - Supports socket auth (no password required with proper permissions)
-
-### Fixed
-- **Socket path as --host now works** - If `--host` starts with `/`, it's auto-detected as a socket path
-  - Example: `--host /var/run/mysqld/mysqld.sock` now works correctly instead of DNS lookup error
-  - Auto-converts to `--socket` internally
-
-## [4.1.1] - 2026-01-25
-
-### Added
-- **`dbbackup_build_info` metric** - Exposes version and git commit as Prometheus labels
-  - Useful for tracking deployed versions across a fleet
-  - Labels: `server`, `version`, `commit`
-
-### Fixed
-- **Documentation clarification**: The `pitr_base` value for `backup_type` label is auto-assigned
-  by `dbbackup pitr base` command. CLI `--backup-type` flag only accepts `full` or `incremental`.
-  This was causing confusion in deployments.
-
-## [4.1.0] - 2026-01-25
-
-### Added
-- **Backup Type Tracking**: All backup metrics now include a `backup_type` label
-  (`full`, `incremental`, or `pitr_base` for PITR base backups)
-- **PITR Metrics**: Complete Point-in-Time Recovery monitoring
-  - `dbbackup_pitr_enabled` - Whether PITR is enabled (1/0)
-  - `dbbackup_pitr_archive_lag_seconds` - Seconds since last WAL/binlog archived
-  - `dbbackup_pitr_chain_valid` - WAL/binlog chain integrity (1=valid)
-  - `dbbackup_pitr_gap_count` - Number of gaps in archive chain
-  - `dbbackup_pitr_archive_count` - Total archived segments
-  - `dbbackup_pitr_archive_size_bytes` - Total archive storage
-  - `dbbackup_pitr_recovery_window_minutes` - Estimated PITR coverage
-- **PITR Alerting Rules**: 6 new alerts for PITR monitoring
-  - PITRArchiveLag, PITRChainBroken, PITRGapsDetected, PITRArchiveStalled,
-    PITRStorageGrowing, PITRDisabledUnexpectedly
-- **`dbbackup_backup_by_type` metric** - Count backups by type
-
-### Changed
-- `dbbackup_backup_total` type changed from counter to gauge for snapshot-based collection
-
-## [3.42.110] - 2026-01-24
-
-### Improved - Code Quality & Testing
-- **Cleaned up 40+ unused code items** found by staticcheck:
-  - Removed unused functions, variables, struct fields, and type aliases
-  - Fixed SA4006 warning (unused value assignment in restore engine)
-  - All packages now pass staticcheck with zero warnings
-
-- **Added golangci-lint integration** to Makefile:
-  - New `make golangci-lint` target with auto-install
-  - Updated `lint` target to include golangci-lint
-  - Updated `install-tools` to install golangci-lint
-
-- **New unit tests** for improved coverage:
-  - `internal/config/config_test.go` - Tests for config initialization, database types, env helpers
-  - `internal/security/security_test.go` - Tests for checksums, path validation, rate limiting, audit logging
-
-## [3.42.109] - 2026-01-24
-
-### Added - Grafana Dashboard & Monitoring Improvements
-- **Enhanced Grafana dashboard** with comprehensive improvements:
-  - Added dashboard description for better discoverability
-  - New collapsible "Backup Overview" row for organization
-  - New **Verification Status** panel showing last backup verification state
-  - Added descriptions to all 17 panels for better understanding
-  - Enabled shared crosshair (graphTooltip=1) for correlated analysis
-  - Added "monitoring" tag for dashboard discovery
-
-- **New Prometheus alerting rules** (`grafana/alerting-rules.yaml`):
-  - `DBBackupRPOCritical` - No backup in 24+ hours (critical)
-  - `DBBackupRPOWarning` - No backup in 12+ hours (warning)
-  - `DBBackupFailure` - Backup failures detected
-  - `DBBackupNotVerified` - Backup not verified in 24h
-  - `DBBackupDedupRatioLow` - Dedup ratio below 10%
-  - `DBBackupDedupDiskGrowth` - Rapid storage growth prediction
-  - `DBBackupExporterDown` - Metrics exporter not responding
-  - `DBBackupMetricsStale` - Metrics not updated in 10+ minutes
-  - `DBBackupNeverSucceeded` - Database never backed up successfully
-
-### Changed
-- **Grafana dashboard layout fixes**:
-  - Fixed overlapping dedup panels (y: 31/36 → 22/27/32)
-  - Adjusted top row panel widths for better balance (5+5+5+4+5=24)
-
-- **Added Makefile** for streamlined development workflow:
-  - `make build` - optimized binary with ldflags
-  - `make test`, `make race`, `make cover` - testing targets
-  - `make lint` - runs vet + staticcheck
-  - `make all-platforms` - cross-platform builds
-
-### Fixed
-- Removed deprecated `netErr.Temporary()` call in cloud retry logic (Go 1.18+)
-- Fixed staticcheck warnings for redundant fmt.Sprintf calls
-- Logger optimizations: buffer pooling, early level check, pre-allocated maps
-- Clone engine now validates disk space before operations
-
-## [3.42.108] - 2026-01-24
-
-### Added - TUI Tools Expansion
-- **Table Sizes** - view top 100 tables sorted by size with row counts, data/index breakdown
-  - Supports PostgreSQL (`pg_stat_user_tables`) and MySQL (`information_schema.TABLES`)
-  - Shows total/data/index sizes, row counts, schema prefix for non-public schemas
-
-- **Kill Connections** - manage active database connections
-  - List all active connections with PID, user, database, state, query preview, duration
-  - Kill single connection or all connections to a specific database
-  - Useful before restore operations to clear blocking sessions
-  - Supports PostgreSQL (`pg_terminate_backend`) and MySQL (`KILL`)
-
-- **Drop Database** - safely drop databases with double confirmation
-  - Lists user databases (system DBs hidden: postgres, template0/1, mysql, sys, etc.)
-  - Requires two confirmations: y/n then type full database name
-  - Auto-terminates connections before drop
-  - Supports PostgreSQL and MySQL
-
-## [3.42.107] - 2026-01-24
-
-### Added - Tools Menu & Blob Statistics
-- **New "Tools" submenu in TUI** - centralized access to utility functions
-  - Blob Statistics - scan database for bytea/blob columns with size analysis
-  - Blob Extract - externalize large objects (coming soon)
-  - Dedup Store Analyze - storage savings analysis (coming soon)
-  - Verify Backup Integrity - backup verification
-  - Catalog Sync - synchronize local catalog (coming soon)
-
-- **New `dbbackup blob stats` CLI command** - analyze blob/bytea columns
-  - Scans `information_schema` for binary column types
-  - Shows row counts, total size, average size, max size per column
-  - Identifies tables storing large binary data for optimization
-  - Supports both PostgreSQL (bytea, oid) and MySQL (blob, mediumblob, longblob)
-  - Provides recommendations for databases with >100MB blob data
-
-## [3.42.106] - 2026-01-24
-
-### Fixed - Cluster Restore Resilience & Performance
-- **Fixed cluster restore failing on missing roles** - harmless "role does not exist" errors no longer abort restore
-  - Added role-related errors to `isIgnorableError()` with warning log
-  - Removed `ON_ERROR_STOP=1` from psql commands (pre-validation catches real corruption)
-  - Restore now continues gracefully when referenced roles don't exist in target cluster
-  - Previously caused 12h+ restores to fail at 94% completion
-
-- **Fixed TUI output scrambling in screen/tmux sessions** - added terminal detection
-  - Uses `go-isatty` to detect non-interactive terminals (backgrounded screen sessions, pipes)
-  - Added `viewSimple()` methods for clean line-by-line output without ANSI escape codes
-  - TUI menu now shows warning when running in non-interactive terminal
-
-### Changed - Consistent Parallel Compression (pgzip)
-- **Migrated all gzip operations to parallel pgzip** - 2-4x faster compression/decompression on multi-core systems
-  - Systematic audit found 17 files using standard `compress/gzip`
-  - All converted to `github.com/klauspost/pgzip` for consistent performance
-  - **Files updated**:
-    - `internal/backup/`: incremental_tar.go, incremental_extract.go, incremental_mysql.go
-    - `internal/wal/`: compression.go (CompressWALFile, DecompressWALFile, VerifyCompressedFile)
-    - `internal/engine/`: clone.go, snapshot_engine.go, mysqldump.go, binlog/file_target.go
-    - `internal/restore/`: engine.go, safety.go, formats.go, error_report.go
-    - `internal/pitr/`: mysql.go, binlog.go
-    - `internal/dedup/`: store.go
-    - `cmd/`: dedup.go, placeholder.go
-  - **Benefit**: Large backup/restore operations now fully utilize available CPU cores
-
-## [3.42.105] - 2026-01-23
-
-### Changed - TUI Visual Cleanup
-- **Removed ASCII box characters** from backup/restore success/failure banners
-  - Replaced `╔═╗║╚╝` boxes with clean `═══` horizontal line separators
-  - Cleaner, more modern appearance in terminal output
-- **Consolidated duplicate styles** in TUI components
-  - Unified check status styles (passed/failed/warning/pending) into global definitions
-  - Reduces code duplication across restore preview and diagnose views
-
-## [3.42.98] - 2025-01-23
-
-### Fixed - Critical Bug Fixes for v3.42.97
-- **Fixed CGO/SQLite build issue** - binaries now work when compiled with `CGO_ENABLED=0`
-  - Switched from `github.com/mattn/go-sqlite3` (requires CGO) to `modernc.org/sqlite` (pure Go)
-  - All cross-compiled binaries now work correctly on all platforms
-  - No more "Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work" errors
-
-- **Fixed MySQL positional database argument being ignored**
-  - `dbbackup backup single <dbname> --db-type mysql` now correctly uses `<dbname>`
-  - Previously defaulted to 'postgres' regardless of positional argument
-  - Also fixed in `backup sample` command
-
-## [3.42.97] - 2025-01-23
-
-### Added - Bandwidth Throttling for Cloud Uploads
-- **New `--bandwidth-limit` flag for cloud operations** - prevent network saturation during business hours
-  - Works with S3, GCS, Azure Blob Storage, MinIO, Backblaze B2
-  - Supports human-readable formats:
-    - `10MB/s`, `50MiB/s` - megabytes per second
-    - `100KB/s`, `500KiB/s` - kilobytes per second  
-    - `1GB/s` - gigabytes per second
-    - `100Mbps` - megabits per second (for network-minded users)
-    - `unlimited` or `0` - no limit (default)
-  - Environment variable: `DBBACKUP_BANDWIDTH_LIMIT`
-  - **Example usage**:
-    ```bash
-    # Limit upload to 10 MB/s during business hours
-    dbbackup cloud upload backup.dump --bandwidth-limit 10MB/s
-    
-    # Environment variable for all operations
-    export DBBACKUP_BANDWIDTH_LIMIT=50MiB/s
-    ```
-  - **Implementation**: Token-bucket style throttling with 100ms windows for smooth rate limiting
-  - **DBA requested feature**: Avoid saturating production network during scheduled backups
-
-## [3.42.96] - 2025-02-01
-
-### Changed - Complete Elimination of Shell tar/gzip Dependencies
-- **All tar/gzip operations now 100% in-process** - ZERO shell dependencies for backup/restore
-  - Removed ALL remaining `exec.Command("tar", ...)` calls
-  - Removed ALL remaining `exec.Command("gzip", ...)` calls
-  - Systematic code audit found and eliminated:
-    - `diagnose.go`: Replaced `tar -tzf` test with direct file open check
-    - `large_restore_check.go`: Replaced `gzip -t` and `gzip -l` with in-process pgzip verification
-    - `pitr/restore.go`: Replaced `tar -xf` with in-process tar extraction
-  - **Benefits**:
-    - No external tool dependencies (works in minimal containers)
-    - 2-4x faster on multi-core systems using parallel pgzip
-    - More reliable error handling with Go-native errors
-    - Consistent behavior across all platforms
-    - Reduced attack surface (no shell spawning)
-  - **Verification**: `strace` and `ps aux` show no tar/gzip/gunzip processes during backup/restore
-  - **Note**: Docker drill container commands still use gunzip for in-container operations (intentional)
-
-## [Unreleased]
-
-### Added - Single Database Extraction from Cluster Backups (CLI + TUI)
-- **Extract and restore individual databases from cluster backups** - selective restore without full cluster restoration
-  - **CLI Commands**:
-    - **List databases**: `dbbackup restore cluster backup.tar.gz --list-databases`
-      - Shows all databases in cluster backup with sizes
-      - Fast scan without full extraction
-    - **Extract single database**: `dbbackup restore cluster backup.tar.gz --database myapp --output-dir /tmp/extract`
-      - Extracts only the specified database dump
-      - No restore, just file extraction
-    - **Restore single database from cluster**: `dbbackup restore cluster backup.tar.gz --database myapp --confirm`
-      - Extracts and restores only one database
-      - Much faster than full cluster restore when you only need one database
-    - **Rename on restore**: `dbbackup restore cluster backup.tar.gz --database myapp --target myapp_test --confirm`
-      - Restore with different database name (useful for testing)
-    - **Extract multiple databases**: `dbbackup restore cluster backup.tar.gz --databases "app1,app2,app3" --output-dir /tmp/extract`
-      - Comma-separated list of databases to extract
-  - **TUI Support**:
-    - Press **'s'** on any cluster backup in archive browser to select individual databases
-    - New **ClusterDatabaseSelector** view shows all databases with sizes
-    - Navigate with arrow keys, select with Enter
-    - Automatic handling when cluster backup selected in single restore mode
-    - Full restore preview and confirmation workflow
-  - **Benefits**:
-    - Faster restores (extract only what you need)
-    - Less disk space usage during restore
-    - Easy database migration/copying
-    - Better testing workflow
-    - Selective disaster recovery
-
-### Performance - Cluster Restore Optimization
-- **Eliminated duplicate archive extraction in cluster restore** - saves 30-50% time on large restores
-  - Previously: Archive was extracted twice (once in preflight validation, once in actual restore)
-  - Now: Archive extracted once and reused for both validation and restore
-  - **Time savings**:
-    - 50 GB cluster: ~3-6 minutes faster
-    - 10 GB cluster: ~1-2 minutes faster
-    - Small clusters (<5 GB): ~30 seconds faster
-  - Optimization automatically enabled when `--diagnose` flag is used
-  - New `ValidateAndExtractCluster()` performs combined validation + extraction
-  - `RestoreCluster()` accepts optional `preExtractedPath` parameter to reuse extracted directory
-  - Disk space checks intelligently skipped when using pre-extracted directory
-  - Maintains backward compatibility - works with and without pre-extraction
-  - Log output shows optimization: `"Using pre-extracted cluster directory ... optimization: skipping duplicate extraction"`
-
-### Improved - Archive Validation
-- **Enhanced tar.gz validation with stream-based checks**
-  - Fast header-only validation (validates gzip + tar structure without full extraction)
-  - Checks gzip magic bytes (0x1f 0x8b) and tar header signature
-  - Reduces preflight validation time from minutes to seconds on large archives
-  - Falls back to full extraction only when necessary (with `--diagnose`)
-
-### Added - PostgreSQL lock verification (CLI + preflight)
-- **`dbbackup verify-locks`** — new CLI command that probes PostgreSQL GUCs (`max_locks_per_transaction`, `max_connections`, `max_prepared_transactions`) and prints total lock capacity plus actionable restore guidance.
-- **Integrated into preflight checks** — preflight now warns/fails when lock settings are insufficient and provides exact remediation commands and recommended restore flags (e.g. `--jobs 1 --parallel-dbs 1`).
-- **Implemented in Go (replaces `verify_postgres_locks.sh`)** with robust parsing, sudo/`psql` fallback and unit-tested decision logic.
-- **Files:** `cmd/verify_locks.go`, `internal/checks/locks.go`, `internal/checks/locks_test.go`, `internal/checks/preflight.go`.
-- **Why:** Prevents repeated parallel-restore failures by surfacing lock-capacity issues early and providing bulletproof guidance.
-
-## [3.42.74] - 2026-01-20 "Resource Profile System + Critical Ctrl+C Fix"
-
-### Critical Bug Fix
-- **Fixed Ctrl+C not working in TUI backup/restore** - Context cancellation was broken in TUI mode
-  - `executeBackupWithTUIProgress()` and `executeRestoreWithTUIProgress()` created new contexts with `WithCancel(parentCtx)`
-  - When user pressed Ctrl+C, `model.cancel()` was called on parent context but execution had separate context
-  - Fixed by using parent context directly instead of creating new one
-  - Ctrl+C/ESC/q now properly propagate cancellation to running operations
-  - Users can now interrupt long-running TUI operations
-
-### Added - Resource Profile System
-- **`--profile` flag for restore operations** with three presets:
-  - **Conservative** (`--profile=conservative`): Single-threaded (`--parallel=1`), minimal memory usage
-    - Best for resource-constrained servers, shared hosting, or when "out of shared memory" errors occur
-    - Automatically enables `LargeDBMode` for better resource management
-  - **Balanced** (default): Auto-detect resources, moderate parallelism
-    - Good default for most scenarios
-  - **Aggressive** (`--profile=aggressive`): Maximum parallelism, all available resources
-    - Best for dedicated database servers with ample resources
-  - **Potato** (`--profile=potato`): Easter egg, same as conservative
-- **Profile system applies to both CLI and TUI**:
-  - CLI: `dbbackup restore cluster backup.tar.gz --profile=conservative --confirm`
-  - TUI: Automatically uses conservative profile for safer interactive operation
-- **User overrides supported**: `--jobs` and `--parallel-dbs` flags override profile settings
-- **New `internal/config/profile.go`** module:
-  - `GetRestoreProfile(name)` - Returns profile settings
-  - `ApplyProfile(cfg, profile, jobs, parallelDBs)` - Applies profile with overrides
-  - `GetProfileDescription(name)` - Human-readable descriptions
-  - `ListProfiles()` - All available profiles
-
-### Added - PostgreSQL Diagnostic Tools
-- **`diagnose_postgres_memory.sh`** - Comprehensive memory and resource analysis script:
-  - System memory overview with usage percentages and warnings
-  - Top 15 memory consuming processes
-  - PostgreSQL-specific memory configuration analysis
-  - Current locks and connections monitoring
-  - Shared memory segments inspection
-  - Disk space and swap usage checks
-  - Identifies other resource consumers (Nessus, Elastic Agent, monitoring tools)
-  - Smart recommendations based on findings
-  - Detects temp file usage (indicator of low work_mem)
-- **`fix_postgres_locks.sh`** - PostgreSQL lock configuration helper:
-  - Automatically increases `max_locks_per_transaction` to 4096
-  - Shows current configuration before applying changes
-  - Calculates total lock capacity
-  - Provides restart commands for different PostgreSQL setups
-  - References diagnostic tool for comprehensive analysis
-
-### Added - Documentation
-- **`RESTORE_PROFILES.md`** - Complete profile guide with real-world scenarios:
-  - Profile comparison table
-  - When to use each profile
-  - Override examples
-  - Troubleshooting guide for "out of shared memory" errors
-  - Integration with diagnostic tools
-- **`email_infra_team.txt`** - Admin communication template (German):
-  - Analysis results template
-  - Problem identification section
-  - Three solution variants (temporary, permanent, workaround)
-  - Includes diagnostic tool references
-
-### Changed - TUI Improvements
-- **TUI mode defaults to conservative profile** for safer operation
-  - Interactive users benefit from stability over speed
-  - Prevents resource exhaustion on shared systems
-  - Can be overridden with environment variable: `export RESOURCE_PROFILE=balanced`
-
-### Fixed
-- Context cancellation in TUI backup operations (critical)
-- Context cancellation in TUI restore operations (critical)
-- Better error diagnostics for "out of shared memory" errors
-- Improved resource detection and management
-
-### Technical Details
-- Profile system respects explicit user flags (`--jobs`, `--parallel-dbs`)
-- Conservative profile sets `cfg.LargeDBMode = true` automatically
-- TUI profile selection logged when `Debug` mode enabled
-- All profiles support both single and cluster restore operations
-
-## [3.42.50] - 2026-01-16 "Ctrl+C Signal Handling Fix"
-
-### Fixed - Proper Ctrl+C/SIGINT Handling in TUI
-- **Added tea.InterruptMsg handling** - Bubbletea v1.3+ sends `InterruptMsg` for SIGINT signals
-  instead of a `KeyMsg` with "ctrl+c", causing cancellation to not work
-- **Fixed cluster restore cancellation** - Ctrl+C now properly cancels running restore operations
-- **Fixed cluster backup cancellation** - Ctrl+C now properly cancels running backup operations
-- **Added interrupt handling to main menu** - Proper cleanup on SIGINT from menu
-- **Orphaned process cleanup** - `cleanup.KillOrphanedProcesses()` called on all interrupt paths
-
-### Changed
-- All TUI execution views now handle both `tea.KeyMsg` ("ctrl+c") and `tea.InterruptMsg`
-- Context cancellation properly propagates to child processes via `exec.CommandContext`
-- No zombie pg_dump/pg_restore/gzip processes left behind on cancellation
-
-## [3.42.49] - 2026-01-16 "Unified Cluster Backup Progress"
-
-### Added - Unified Progress Display for Cluster Backup
-- **Combined overall progress bar** for cluster backup showing all phases:
-  - Phase 1/3: Backing up Globals (0-15% of overall)
-  - Phase 2/3: Backing up Databases (15-90% of overall)
-  - Phase 3/3: Compressing Archive (90-100% of overall)
-- **Current database indicator** - Shows which database is currently being backed up
-- **Phase-aware progress tracking** - New fields in backup progress state:
-  - `overallPhase` - Current phase (1=globals, 2=databases, 3=compressing)
-  - `phaseDesc` - Human-readable phase description
-- **Dual progress bars** for cluster backup:
-  - Overall progress bar showing combined operation progress
-  - Database count progress bar showing individual database progress
-
-### Changed
-- Cluster backup TUI now shows unified progress display matching restore
-- Progress callbacks now include phase information
-- Better visual feedback during entire cluster backup operation
-
-## [3.42.48] - 2026-01-15 "Unified Cluster Restore Progress"
-
-### Added - Unified Progress Display for Cluster Restore
-- **Combined overall progress bar** showing progress across all restore phases:
-  - Phase 1/3: Extracting Archive (0-60% of overall)
-  - Phase 2/3: Restoring Globals (60-65% of overall)
-  - Phase 3/3: Restoring Databases (65-100% of overall)
-- **Current database indicator** - Shows which database is currently being restored
-- **Phase-aware progress tracking** - New fields in progress state:
-  - `overallPhase` - Current phase (1=extraction, 2=globals, 3=databases)
-  - `currentDB` - Name of database currently being restored
-  - `extractionDone` - Boolean flag for phase transition
-- **Dual progress bars** for cluster restore:
-  - Overall progress bar showing combined operation progress
-  - Phase-specific progress bar (extraction bytes or database count)
-
-### Changed
-- Cluster restore TUI now shows unified progress display
-- Progress callbacks now set phase and current database information
-- Extraction completion triggers automatic transition to globals phase
-- Database restore phase shows current database name with spinner
-
-### Improved
-- Better visual feedback during entire cluster restore operation
-- Clear phase indicators help users understand restore progress
-- Overall progress percentage gives better time estimates
-
-## [3.42.35] - 2026-01-15 "TUI Detailed Progress"
-
-### Added - Enhanced TUI Progress Display
-- **Detailed progress bar in TUI restore** - schollz-style progress bar with:
-  - Byte progress display (e.g., `245 MB / 1.2 GB`)
-  - Transfer speed calculation (e.g., `45 MB/s`)
-  - ETA prediction for long operations
-  - Unicode block-based visual bar
-- **Real-time extraction progress** - Archive extraction now reports actual bytes processed
-- **Go-native tar extraction** - Uses Go's `archive/tar` + `compress/gzip` when progress callback is set
-- **New `DetailedProgress` component** in TUI package:
-  - `NewDetailedProgress(total, description)` - Byte-based progress
-  - `NewDetailedProgressItems(total, description)` - Item count progress
-  - `NewDetailedProgressSpinner(description)` - Indeterminate spinner
-  - `RenderProgressBar(width)` - Generate schollz-style output
-- **Progress callback API** in restore engine:
-  - `SetProgressCallback(func(current, total int64, description string))` 
-  - Allows TUI to receive real-time progress updates from restore operations
-- **Shared progress state** pattern for Bubble Tea integration
-
-### Changed
-- TUI restore execution now shows detailed byte progress during archive extraction
-- Cluster restore shows extraction progress instead of just spinner
-- Falls back to shell `tar` command when no progress callback is set (faster)
-
-### Technical Details
-- `progressReader` wrapper tracks bytes read through gzip/tar pipeline
-- Throttled progress updates (every 100ms) to avoid UI flooding
-- Thread-safe shared state pattern for cross-goroutine progress updates
-
-## [3.42.34] - 2026-01-14 "Filesystem Abstraction"
-
-### Added - spf13/afero for Filesystem Abstraction
-- **New `internal/fs` package** for testable filesystem operations
-- **In-memory filesystem** for unit testing without disk I/O
-- **Global FS interface** that can be swapped for testing:
-  ```go
-  fs.SetFS(afero.NewMemMapFs())  // Use memory
-  fs.ResetFS()                    // Back to real disk
-  ```
-- **Wrapper functions** for all common file operations:
-  - `ReadFile`, `WriteFile`, `Create`, `Open`, `Remove`, `RemoveAll`
-  - `Mkdir`, `MkdirAll`, `ReadDir`, `Walk`, `Glob`
-  - `Exists`, `DirExists`, `IsDir`, `IsEmpty`
-  - `TempDir`, `TempFile`, `CopyFile`, `FileSize`
-- **Testing helpers**:
-  - `WithMemFs(fn)` - Execute function with temp in-memory FS
-  - `SetupTestDir(files)` - Create test directory structure
-- **Comprehensive test suite** demonstrating usage
-
-### Changed
-- Upgraded afero from v1.10.0 to v1.15.0
-
-## [3.42.33] - 2026-01-14 "Exponential Backoff Retry"
-
-### Added - cenkalti/backoff for Cloud Operation Retry
-- **Exponential backoff retry** for all cloud operations (S3, Azure, GCS)
-- **Retry configurations**:
-  - `DefaultRetryConfig()` - 5 retries, 500ms→30s backoff, 5 min max
-  - `AggressiveRetryConfig()` - 10 retries, 1s→60s backoff, 15 min max
-  - `QuickRetryConfig()` - 3 retries, 100ms→5s backoff, 30s max
-- **Smart error classification**:
-  - `IsPermanentError()` - Auth/bucket errors (no retry)
-  - `IsRetryableError()` - Timeout/network errors (retry)
-- **Retry logging** - Each retry attempt is logged with wait duration
-
-### Changed
-- S3 simple upload, multipart upload, download now retry on transient failures
-- Azure simple upload, download now retry on transient failures
-- GCS upload, download now retry on transient failures
-- Large file multipart uploads use `AggressiveRetryConfig()` (more retries)
-
-## [3.42.32] - 2026-01-14 "Cross-Platform Colors"
-
-### Added - fatih/color for Cross-Platform Terminal Colors
-- **Windows-compatible colors** - Native Windows console API support
-- **Color helper functions** in `logger` package:
-  - `Success()`, `Error()`, `Warning()`, `Info()` - Status messages with icons
-  - `Header()`, `Dim()`, `Bold()` - Text styling
-  - `Green()`, `Red()`, `Yellow()`, `Cyan()` - Colored text
-  - `StatusLine()`, `TableRow()` - Formatted output
-  - `DisableColors()`, `EnableColors()` - Runtime control
-- **Consistent color scheme** across all log levels
-
-### Changed
-- Logger `CleanFormatter` now uses fatih/color instead of raw ANSI codes
-- All progress indicators use fatih/color for `[OK]`/`[FAIL]` status
-- Automatic color detection (disabled for non-TTY)
-
-## [3.42.31] - 2026-01-14 "Visual Progress Bars"
-
-### Added - schollz/progressbar for Enhanced Progress Display
-- **Visual progress bars** for cloud uploads/downloads with:
-  - Byte transfer display (e.g., `245 MB / 1.2 GB`)
-  - Transfer speed (e.g., `45 MB/s`)
-  - ETA prediction
-  - Color-coded progress with Unicode blocks
-- **Checksum verification progress** - visual progress while calculating SHA-256
-- **Spinner for indeterminate operations** - Braille-style spinner when size unknown
-- New progress types: `NewSchollzBar()`, `NewSchollzBarItems()`, `NewSchollzSpinner()`
-- Progress bar `Writer()` method for io.Copy integration
-
-### Changed
-- Cloud download shows real-time byte progress instead of 10% log messages
-- Cloud upload shows visual progress bar instead of debug logs  
-- Checksum verification shows progress for large files
-
-## [3.42.30] - 2026-01-09 "Better Error Aggregation"
-
-### Added - go-multierror for Cluster Restore Errors
-- **Enhanced error reporting** - Now shows ALL database failures, not just a count
-- Uses `hashicorp/go-multierror` for proper error aggregation
-- Each failed database error is preserved with full context
-- Bullet-pointed error output for readability:
-  ```
-  cluster restore completed with 3 failures:
-  3 database(s) failed:
-    • db1: restore failed: max_locks_per_transaction exceeded
-    • db2: restore failed: connection refused
-    • db3: failed to create database: permission denied
-  ```
-
-### Changed
-- Replaced string slice error collection with proper `*multierror.Error`
-- Thread-safe error aggregation with dedicated mutex
-- Improved error wrapping with `%w` for error chain preservation
-
 ## [3.42.10] - 2026-01-08 "Code Quality"
 
 ### Fixed - Code Quality Issues
@@ -1710,7 +263,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.41.0] - 2026-01-07 "The Pre-Flight Check"
 
-### Added - Pre-Restore Validation
+### Added - 🛡️ Pre-Restore Validation
 
 **Automatic Dump Validation Before Restore:**
 - SQL dump files are now validated BEFORE attempting restore
@@ -1748,7 +301,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.40.0] - 2026-01-05 "The Diagnostician"
 
-### Added - Restore Diagnostics & Error Reporting
+### Added - 🔍 Restore Diagnostics & Error Reporting
 
 **Backup Diagnosis Command:**
 - `restore diagnose <archive>` - Deep analysis of backup files before restore
@@ -1797,7 +350,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.2.0] - 2025-12-13 "The Margin Eraser"
 
-### Added - Physical Backup Revolution
+### Added - 🚀 Physical Backup Revolution
 
 **MySQL Clone Plugin Integration:**
 - Native physical backup using MySQL 8.0.17+ Clone Plugin
@@ -1959,7 +512,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.0.0] - 2025-11-26
 
-### Added - AES-256-GCM Encryption (Phase 4)
+### Added - 🔐 AES-256-GCM Encryption (Phase 4)
 
 **Secure Backup Encryption:**
 - **Algorithm**: AES-256-GCM authenticated encryption (prevents tampering)
@@ -2007,7 +560,7 @@ head -c 32 /dev/urandom | base64 > encryption.key
 - `internal/backup/encryption.go` - Backup encryption operations
 - Total: ~1,200 lines across 13 files
 
-### Added - Incremental Backups (Phase 3B)
+### Added - 📦 Incremental Backups (Phase 3B)
 
 **MySQL/MariaDB Incremental Backups:**
 - **Change Detection**: mtime-based file modification tracking
@@ -2078,11 +631,11 @@ head -c 32 /dev/urandom | base64 > encryption.key
 - **Metadata Format**: Extended with encryption and incremental fields
 
 ### Testing
-- Encryption tests: 4 tests passing (TestAESEncryptionDecryption, TestKeyDerivation, TestKeyValidation, TestLargeData)
-- Incremental tests: 2 tests passing (TestIncrementalBackupRestore, TestIncrementalBackupErrors)
-- Roundtrip validation: Encrypt → Decrypt → Verify (data matches perfectly)
-- Build: All platforms compile successfully
-- Interface compatibility: PostgreSQL and MySQL engines share test suite
+- ✅ Encryption tests: 4 tests passing (TestAESEncryptionDecryption, TestKeyDerivation, TestKeyValidation, TestLargeData)
+- ✅ Incremental tests: 2 tests passing (TestIncrementalBackupRestore, TestIncrementalBackupErrors)
+- ✅ Roundtrip validation: Encrypt → Decrypt → Verify (data matches perfectly)
+- ✅ Build: All platforms compile successfully
+- ✅ Interface compatibility: PostgreSQL and MySQL engines share test suite
 
 ### Documentation
 - Updated README.md with encryption and incremental sections
@@ -2131,12 +684,12 @@ head -c 32 /dev/urandom | base64 > encryption.key
   - `disk_check_netbsd.go` - NetBSD disk space stub
 - **Build Tags**: Proper Go build constraints for platform-specific code
 - **All Platforms Building**: 10/10 platforms successfully compile
-  - Linux (amd64, arm64, armv7)
-  - macOS (Intel, Apple Silicon)
-  - Windows (Intel, ARM)
-  - FreeBSD amd64
-  - OpenBSD amd64
-  - - NetBSD amd64
+  - ✅ Linux (amd64, arm64, armv7)
+  - ✅ macOS (Intel, Apple Silicon)
+  - ✅ Windows (Intel, ARM)
+  - ✅ FreeBSD amd64
+  - ✅ OpenBSD amd64
+  - ✅ NetBSD amd64
 
 ### Changed
 - **Cloud Auto-Upload**: When `CloudEnabled=true` and `CloudAutoUpload=true`, backups automatically upload after creation

CLOUD.md

@@ -573,7 +573,7 @@ dbbackup cleanup minio://test-backups/test/ --retention-days 7 --dry-run
 
 3. **Use compression:**
    ```bash
-   --compression 6  # Reduces upload size
+   --compression gzip  # Reduces upload size
    ```
 
 ### Reliability
@@ -693,7 +693,7 @@ Error: checksum mismatch: expected abc123, got def456
 for db in db1 db2 db3; do
     dbbackup backup single $db \
         --cloud s3://production-backups/daily/$db/ \
-        --compression 6
+        --compression gzip
 done
 
 # Cleanup old backups (keep 30 days, min 10 backups)

CONTRIBUTING.md

@@ -17,9 +17,9 @@ Be respectful, constructive, and professional in all interactions. We're buildin
 
 **Bug Report Template:**
 ```
-**Version:** dbbackup v5.7.10
+**Version:** dbbackup v3.42.1
 **OS:** Linux/macOS/BSD
-**Database:** PostgreSQL 14+ / MySQL 8.0+ / MariaDB 10.6+
+**Database:** PostgreSQL 14 / MySQL 8.0 / MariaDB 10.6
 **Command:** The exact command that failed
 **Error:** Full error message and stack trace
 **Expected:** What you expected to happen
@@ -43,12 +43,12 @@ We welcome feature requests! Please include:
 4. Create a feature branch
 
 **PR Requirements:**
-- - All tests pass (`go test -v ./...`)
-- - New tests added for new features
-- - Documentation updated (README.md, comments)
-- - Code follows project style
-- - Commit messages are clear and descriptive
-- - No breaking changes without discussion
+- ✅ All tests pass (`go test -v ./...`)
+- ✅ New tests added for new features
+- ✅ Documentation updated (README.md, comments)
+- ✅ Code follows project style
+- ✅ Commit messages are clear and descriptive
+- ✅ No breaking changes without discussion
 
 ## Development Setup
 
@@ -292,4 +292,4 @@ By contributing, you agree that your contributions will be licensed under the Ap
 
 ---
 
-**Thank you for contributing to dbbackup!** 
+**Thank you for contributing to dbbackup!** 🎉

ENGINES.md

@@ -16,17 +16,17 @@ DBBackup now includes a modular backup engine system with multiple strategies:
 ## Quick Start
 
 ```bash
-# List available engines for your MySQL/MariaDB environment
+# List available engines
 dbbackup engine list
 
-# Get detailed information on a specific engine
-dbbackup engine info clone
+# Auto-select best engine for your environment
+dbbackup engine select
 
-# Get engine info for current environment
-dbbackup engine info
+# Perform physical backup with auto-selection
+dbbackup physical-backup --output /backups/db.tar.gz
 
-# Use engines with backup commands (auto-detection)
-dbbackup backup single mydb --db-type mysql
+# Stream directly to S3 (no local storage needed)
+dbbackup stream-backup --target s3://bucket/backups/db.tar.gz --workers 8
 ```
 
 ## Engine Descriptions
@@ -36,7 +36,7 @@ dbbackup backup single mydb --db-type mysql
 Traditional logical backup using mysqldump. Works with all MySQL/MariaDB versions.
 
 ```bash
-dbbackup backup single mydb --db-type mysql
+dbbackup physical-backup --engine mysqldump --output backup.sql.gz
 ```
 
 Features:
@@ -370,39 +370,6 @@ SET GLOBAL gtid_mode = ON;
 4. **Monitoring**: Check progress with `dbbackup status`
 5. **Testing**: Verify restores regularly with `dbbackup verify`
 
-## Authentication
-
-### Password Handling (Security)
-
-For security reasons, dbbackup does **not** support `--password` as a command-line flag. Passwords should be passed via environment variables:
-
-```bash
-# MySQL/MariaDB
-export MYSQL_PWD='your_password'
-dbbackup backup single mydb --db-type mysql
-
-# PostgreSQL  
-export PGPASSWORD='your_password'
-dbbackup backup single mydb --db-type postgres
-```
-
-Alternative methods:
-- **MySQL/MariaDB**: Use socket authentication with `--socket /var/run/mysqld/mysqld.sock`
-- **PostgreSQL**: Use peer authentication by running as the postgres user
-
-### PostgreSQL Peer Authentication
-
-When using PostgreSQL with peer authentication (running as the `postgres` user), the native engine will automatically fall back to `pg_dump` since peer auth doesn't provide a password for the native protocol:
-
-```bash
-# This works - dbbackup detects peer auth and uses pg_dump
-sudo -u postgres dbbackup backup single mydb -d postgres
-```
-
-You'll see: `INFO: Native engine requires password auth, using pg_dump with peer authentication`
-
-This is expected behavior, not an error.
-
 ## See Also
 
 - [PITR.md](PITR.md) - Point-in-Time Recovery guide

GCS.md

@@ -293,8 +293,8 @@ dbbackup cloud download \
 # Manual delete
 dbbackup cloud delete "gs://prod-backups/postgres/old_backup.sql"
 
-# Automatic cleanup (keep last 7 days, min 5 backups)
-dbbackup cleanup "gs://prod-backups/postgres/" --retention-days 7 --min-backups 5
+# Automatic cleanup (keep last 7 backups)
+dbbackup cleanup "gs://prod-backups/postgres/" --keep 7
 ```
 
 ### Scheduled Backups
@@ -310,7 +310,7 @@ dbbackup backup single production_db \
   --compression 9
 
 # Cleanup old backups
-dbbackup cleanup "gs://prod-backups/postgres/" --retention-days 30 --min-backups 5
+dbbackup cleanup "gs://prod-backups/postgres/" --keep 30
 ```
 
 **Crontab:**
@@ -482,7 +482,7 @@ Tests include:
 ### 4. Reliability
 
 - Test **restore procedures** regularly
-- Use **retention policies**: `--retention-days 30`
+- Use **retention policies**: `--keep 30`
 - Enable **object versioning** (30-day recovery)
 - Use **multi-region** buckets for disaster recovery
 - Monitor backup success with Cloud Monitoring

Makefile

@@ -1,126 +0,0 @@
-# Makefile for dbbackup
-# Provides common development workflows
-
-.PHONY: build test lint vet clean install-tools help race cover golangci-lint
-
-# Build variables
-VERSION := $(shell grep 'version.*=' main.go | head -1 | sed 's/.*"\(.*\)".*/\1/')
-BUILD_TIME := $(shell date -u '+%Y-%m-%d_%H:%M:%S_UTC')
-GIT_COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
-LDFLAGS := -w -s -X main.version=$(VERSION) -X main.buildTime=$(BUILD_TIME) -X main.gitCommit=$(GIT_COMMIT)
-
-# Default target
-all: lint test build
-
-## build: Build the binary with optimizations
-build:
-	@echo "🔨 Building dbbackup $(VERSION)..."
-	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o bin/dbbackup .
-	@echo "✅ Built bin/dbbackup"
-
-## build-debug: Build with debug symbols (for debugging)
-build-debug:
-	@echo "🔨 Building dbbackup $(VERSION) with debug symbols..."
-	go build -ldflags="-X main.version=$(VERSION) -X main.buildTime=$(BUILD_TIME) -X main.gitCommit=$(GIT_COMMIT)" -o bin/dbbackup-debug .
-	@echo "✅ Built bin/dbbackup-debug"
-
-## test: Run tests
-test:
-	@echo "🧪 Running tests..."
-	go test ./...
-
-## race: Run tests with race detector
-race:
-	@echo "🏃 Running tests with race detector..."
-	go test -race ./...
-
-## cover: Run tests with coverage report
-cover:
-	@echo "📊 Running tests with coverage..."
-	go test -cover ./... | tee coverage.txt
-	@echo "📄 Coverage saved to coverage.txt"
-
-## cover-html: Generate HTML coverage report
-cover-html:
-	@echo "📊 Generating HTML coverage report..."
-	go test -coverprofile=coverage.out ./...
-	go tool cover -html=coverage.out -o coverage.html
-	@echo "📄 Coverage report: coverage.html"
-
-## lint: Run all linters
-lint: vet staticcheck golangci-lint
-
-## vet: Run go vet
-vet:
-	@echo "🔍 Running go vet..."
-	go vet ./...
-
-## staticcheck: Run staticcheck (install if missing)
-staticcheck:
-	@echo "🔍 Running staticcheck..."
-	@if ! command -v staticcheck >/dev/null 2>&1; then \
-		echo "Installing staticcheck..."; \
-		go install honnef.co/go/tools/cmd/staticcheck@latest; \
-	fi
-	$$(go env GOPATH)/bin/staticcheck ./...
-
-## golangci-lint: Run golangci-lint (comprehensive linting)
-golangci-lint:
-	@echo "🔍 Running golangci-lint..."
-	@if ! command -v golangci-lint >/dev/null 2>&1; then \
-		echo "Installing golangci-lint..."; \
-		go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest; \
-	fi
-	$$(go env GOPATH)/bin/golangci-lint run --timeout 5m
-
-## install-tools: Install development tools
-install-tools:
-	@echo "📦 Installing development tools..."
-	go install honnef.co/go/tools/cmd/staticcheck@latest
-	go install golang.org/x/tools/cmd/goimports@latest
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-	@echo "✅ Tools installed"
-
-## fmt: Format code
-fmt:
-	@echo "🎨 Formatting code..."
-	gofmt -w -s .
-	@which goimports > /dev/null && goimports -w . || true
-
-## tidy: Tidy and verify go.mod
-tidy:
-	@echo "🧹 Tidying go.mod..."
-	go mod tidy
-	go mod verify
-
-## update: Update dependencies
-update:
-	@echo "⬆️  Updating dependencies..."
-	go get -u ./...
-	go mod tidy
-
-## clean: Clean build artifacts
-clean:
-	@echo "🧹 Cleaning..."
-	rm -rf bin/dbbackup bin/dbbackup-debug
-	rm -f coverage.out coverage.txt coverage.html
-	go clean -cache -testcache
-
-## docker: Build Docker image
-docker:
-	@echo "🐳 Building Docker image..."
-	docker build -t dbbackup:$(VERSION) .
-
-## all-platforms: Build for all platforms (uses build_all.sh)
-all-platforms:
-	@echo "🌍 Building for all platforms..."
-	./build_all.sh
-
-## help: Show this help
-help:
-	@echo "dbbackup Makefile"
-	@echo ""
-	@echo "Usage: make [target]"
-	@echo ""
-	@echo "Targets:"
-	@grep -E '^## ' Makefile | sed 's/## /  /'

NATIVE_ENGINE_SUMMARY.md

@@ -1,266 +0,0 @@
-# Native Database Engine Implementation Summary
-
-## Current Status: Full Native Engine Support (v5.5.0+)
-
-**Goal:** Zero dependency on external tools (pg_dump, pg_restore, mysqldump, mysql)
-
-**Reality:** Native engine is **NOW AVAILABLE FOR ALL OPERATIONS** when using `--native` flag!
-
-## Engine Support Matrix
-
-| Operation | Default Mode | With `--native` Flag |
-|-----------|-------------|---------------------|
-| **Single DB Backup** | ✅ Native Go | ✅ Native Go |
-| **Single DB Restore** | ✅ Native Go | ✅ Native Go |
-| **Cluster Backup** | pg_dump (custom format) | ✅ **Native Go** (SQL format) |
-| **Cluster Restore** | pg_restore | ✅ **Native Go** (for .sql.gz files) |
-
-### NEW: Native Cluster Operations (v5.5.0)
-
-```bash
-# Native cluster backup - creates SQL format dumps, no pg_dump needed!
-./dbbackup backup cluster --native
-
-# Native cluster restore - restores .sql.gz files with pure Go, no pg_restore!
-./dbbackup restore cluster backup.tar.gz --native --confirm
-```
-
-### Format Selection
-
-| Format | Created By | Restored By | Size | Speed |
-|--------|------------|-------------|------|-------|
-| **SQL** (.sql.gz) | Native Go or pg_dump | Native Go or psql | Larger | Medium |
-| **Custom** (.dump) | pg_dump -Fc | pg_restore only | Smaller | Fast (parallel) |
-
-### When to Use Native Mode
-
-**Use `--native` when:**
-- External tools (pg_dump/pg_restore) are not installed
-- Running in minimal containers without PostgreSQL client
-- Building a single statically-linked binary deployment
-- Simplifying disaster recovery procedures
-
-**Use default mode when:**
-- Maximum backup/restore performance is critical
-- You need parallel restore with `-j` option
-- Backup size is a primary concern
-
-## Architecture Overview
-
-### Core Native Engines
-
-1. **PostgreSQL Native Engine** (`internal/engine/native/postgresql.go`)
-   - Pure Go implementation using `pgx/v5` driver
-   - Direct PostgreSQL protocol communication
-   - Native SQL generation and COPY data export
-   - Advanced data type handling with proper escaping
-
-2. **MySQL Native Engine** (`internal/engine/native/mysql.go`)
-   - Pure Go implementation using `go-sql-driver/mysql`
-   - Direct MySQL protocol communication
-   - Batch INSERT generation with proper data type handling
-   - Binary data support with hex encoding
-
-3. **Engine Manager** (`internal/engine/native/manager.go`)
-   - Pluggable architecture for engine selection
-   - Configuration-based engine initialization
-   - Unified backup orchestration across engines
-
-4. **Restore Engine Framework** (`internal/engine/native/restore.go`)
-   - Parses SQL statements from backup
-   - Uses `CopyFrom` for COPY data
-   - Progress tracking and status reporting
-
-## Configuration
-
-```bash
-# SINGLE DATABASE (native is default for SQL format)
-./dbbackup backup single mydb              # Uses native engine
-./dbbackup restore backup.sql.gz --native  # Uses native engine
-
-# CLUSTER BACKUP
-./dbbackup backup cluster                  # Default: pg_dump custom format
-./dbbackup backup cluster --native         # NEW: Native Go, SQL format
-
-# CLUSTER RESTORE
-./dbbackup restore cluster backup.tar.gz --confirm          # Default: pg_restore
-./dbbackup restore cluster backup.tar.gz --native --confirm # NEW: Native Go for .sql.gz files
-
-# FALLBACK MODE
-./dbbackup backup cluster --native --fallback-tools  # Try native, fall back if fails
-```
-
-### Config Defaults
-
-```go
-// internal/config/config.go
-UseNativeEngine: true,   // Native is default for single DB
-FallbackToTools: true,   // Fall back to tools if native fails
-```
-
-## When Native Engine is Used
-
-### ✅ Native Engine for Single DB (Default)
-
-```bash
-# Single DB backup to SQL format
-./dbbackup backup single mydb
-# → Uses native.PostgreSQLNativeEngine.Backup()
-# → Pure Go: pgx COPY TO STDOUT
-
-# Single DB restore from SQL format  
-./dbbackup restore mydb_backup.sql.gz --database=mydb
-# → Uses native.PostgreSQLRestoreEngine.Restore()
-# → Pure Go: pgx CopyFrom()
-```
-
-### ✅ Native Engine for Cluster (With --native Flag)
-
-```bash
-# Cluster backup with native engine
-./dbbackup backup cluster --native
-# → For each database: native.PostgreSQLNativeEngine.Backup()
-# → Creates .sql.gz files (not .dump)
-# → Pure Go: no pg_dump required!
-
-# Cluster restore with native engine
-./dbbackup restore cluster backup.tar.gz --native --confirm
-# → For each .sql.gz: native.PostgreSQLRestoreEngine.Restore()
-# → Pure Go: no pg_restore required!
-```
-
-### External Tools (Default for Cluster, or Custom Format)
-
-```bash
-# Cluster backup (default - uses custom format for efficiency)
-./dbbackup backup cluster
-# → Uses pg_dump -Fc for each database
-# → Reason: Custom format enables parallel restore
-
-# Cluster restore (default)
-./dbbackup restore cluster backup.tar.gz --confirm
-# → Uses pg_restore for .dump files
-# → Uses native engine for .sql.gz files automatically!
-
-# Single DB restore from .dump file
-./dbbackup restore mydb_backup.dump --database=mydb
-# → Uses pg_restore
-# → Reason: Custom format binary file
-```
-
-## Performance Comparison
-
-| Method | Format | Backup Speed | Restore Speed | File Size | External Tools |
-|--------|--------|-------------|---------------|-----------|----------------|
-| Native Go | SQL.gz | Medium | Medium | Larger | ❌ None |
-| pg_dump/restore | Custom | Fast | Fast (parallel) | Smaller | ✅ Required |
-
-### Recommendation
-
-| Scenario | Recommended Mode |
-|----------|------------------|
-| No PostgreSQL tools installed | `--native` |
-| Minimal container deployment | `--native` |
-| Maximum performance needed | Default (pg_dump) |
-| Large databases (>10GB) | Default with `-j8` |
-| Disaster recovery simplicity | `--native` |
-
-## Implementation Details
-
-### Native Backup Flow
-
-```
-User → backupCmd → cfg.UseNativeEngine=true → runNativeBackup()
-                                                    ↓
-                               native.EngineManager.BackupWithNativeEngine()
-                                                    ↓
-                               native.PostgreSQLNativeEngine.Backup()
-                                                    ↓
-                               pgx: COPY table TO STDOUT → SQL file
-```
-
-### Native Restore Flow
-
-```
-User → restoreCmd → cfg.UseNativeEngine=true → runNativeRestore()
-                                                     ↓
-                                native.EngineManager.RestoreWithNativeEngine()
-                                                     ↓
-                                native.PostgreSQLRestoreEngine.Restore()
-                                                     ↓
-                                Parse SQL → pgx CopyFrom / Exec → Database
-```
-
-### Native Cluster Flow (NEW in v5.5.0)
-
-```
-User → backup cluster --native
-                ↓
-        For each database:
-            native.PostgreSQLNativeEngine.Backup()
-                     ↓
-            Create .sql.gz file (not .dump)
-                     ↓
-        Package all .sql.gz into tar.gz archive
-
-User → restore cluster --native --confirm
-                ↓
-        Extract tar.gz → .sql.gz files
-                ↓
-        For each .sql.gz:
-            native.PostgreSQLRestoreEngine.Restore()
-                     ↓
-            Parse SQL → pgx CopyFrom → Database
-```
-
-### External Tools Flow (Default Cluster)
-
-```
-User → restoreClusterCmd → engine.RestoreCluster()
-                                    ↓
-                           Extract tar.gz → .dump files
-                                    ↓
-                           For each .dump:
-                               cleanup.SafeCommand("pg_restore", args...)
-                                    ↓
-                           PostgreSQL restores data
-```
-
-## CLI Flags
-
-```bash
---native              # Use native engine for backup/restore (works for cluster too!)
---fallback-tools      # Fall back to external if native fails
---native-debug        # Enable native engine debug logging
-```
-
-## Future Improvements
-
-1. ~~Add SQL format option for cluster backup~~ ✅ **DONE in v5.5.0**
-
-2. **Implement custom format parser in Go**
-   - Very complex (PostgreSQL proprietary format)
-   - Would enable native restore of .dump files
-
-3. **Add parallel native restore**
-   - Parse SQL file into table chunks
-   - Restore multiple tables concurrently
-
-## Summary
-
-| Feature | Default | With `--native` |
-|---------|---------|-----------------|
-| Single DB backup (SQL) | ✅ Native Go | ✅ Native Go |
-| Single DB restore (SQL) | ✅ Native Go | ✅ Native Go |
-| Single DB restore (.dump) | pg_restore | pg_restore |
-| Cluster backup | pg_dump (.dump) | ✅ **Native Go (.sql.gz)** |
-| Cluster restore (.dump) | pg_restore | pg_restore |
-| Cluster restore (.sql.gz) | psql | ✅ **Native Go** |
-| MySQL backup | ✅ Native Go | ✅ Native Go |
-| MySQL restore | ✅ Native Go | ✅ Native Go |
-
-**Bottom Line:** With `--native` flag, dbbackup can now perform **ALL operations** without external tools, as long as you create native-format backups. This enables single-binary deployment with zero PostgreSQL client dependencies.
-
-**Bottom Line:** With `--native` flag, dbbackup can now perform **ALL operations** without external tools, as long as you create native-format backups. This enables single-binary deployment with zero PostgreSQL client dependencies.
-
-**Bottom Line:** Native engine works for SQL format operations. Cluster operations use external tools because PostgreSQL's custom format provides better performance and features.

OPENSOURCE_ALTERNATIVE.md

@@ -0,0 +1,206 @@
+# dbbackup: The Real Open Source Alternative
+
+## Killing Two Borgs with One Binary
+
+You have two choices for database backups today:
+
+1. **Pay $2,000-10,000/year per server** for Veeam, Commvault, or Veritas
+2. **Wrestle with Borg/restic** - powerful, but never designed for databases
+
+**dbbackup** eliminates both problems with a single, zero-dependency binary.
+
+## The Problem with Commercial Backup
+
+| What You Pay For | What You Actually Get |
+|------------------|----------------------|
+| $10,000/year | Heavy agents eating CPU |
+| Complex licensing | Vendor lock-in to proprietary formats |
+| "Enterprise support" | Recovery that requires calling support |
+| "Cloud integration" | Upload to S3... eventually |
+
+## The Problem with Borg/Restic
+
+Great tools. Wrong use case.
+
+| Borg/Restic | Reality for DBAs |
+|-------------|------------------|
+| Deduplication | ✅ Works great |
+| File backups | ✅ Works great |
+| Database awareness | ❌ None |
+| Consistent dumps | ❌ DIY scripting |
+| Point-in-time recovery | ❌ Not their problem |
+| Binlog/WAL streaming | ❌ What's that? |
+
+You end up writing wrapper scripts. Then more scripts. Then a monitoring layer. Then you've built half a product anyway.
+
+## What Open Source Really Means
+
+**dbbackup** delivers everything - in one binary:
+
+| Feature | Veeam | Borg/Restic | dbbackup |
+|---------|-------|-------------|----------|
+| Deduplication | ❌ | ✅ | ✅ Native CDC |
+| Database-aware | ✅ | ❌ | ✅ MySQL + PostgreSQL |
+| Consistent snapshots | ✅ | ❌ | ✅ LVM/ZFS/Btrfs |
+| PITR (Point-in-Time) | ❌ | ❌ | ✅ Sub-second RPO |
+| Binlog/WAL streaming | ❌ | ❌ | ✅ Continuous |
+| Direct cloud streaming | ❌ | ✅ | ✅ S3/GCS/Azure |
+| Zero dependencies | ❌ | ❌ | ✅ Single binary |
+| License cost | $$$$ | Free | **Free (Apache 2.0)** |
+
+## Deduplication: We Killed the Borg
+
+Content-defined chunking, just like Borg - but built for database dumps:
+
+```bash
+# First backup: 5MB stored
+dbbackup dedup backup mydb.dump
+
+# Second backup (modified): only 1.6KB new data!
+# 100% deduplication ratio
+dbbackup dedup backup mydb_modified.dump
+```
+
+### How It Works
+- **Gear Hash CDC** - Content-defined chunking with 92%+ overlap detection
+- **SHA-256 Content-Addressed** - Chunks stored by hash, automatic dedup
+- **AES-256-GCM Encryption** - Per-chunk encryption
+- **Gzip Compression** - Enabled by default
+- **SQLite Index** - Fast lookups, portable metadata
+
+### Storage Efficiency
+
+| Scenario | Borg | dbbackup |
+|----------|------|----------|
+| Daily 10GB database | 10GB + ~2GB/day | 10GB + ~2GB/day |
+| Same data, knows it's a DB | Scripts needed | **Native support** |
+| Restore to point-in-time | ❌ | ✅ Built-in |
+
+Same dedup math. Zero wrapper scripts.
+
+## Enterprise Features, Zero Enterprise Pricing
+
+### Physical Backups (MySQL 8.0.17+)
+```bash
+# Native Clone Plugin - no XtraBackup needed
+dbbackup backup single mydb --db-type mysql --cloud s3://bucket/
+```
+
+### Filesystem Snapshots
+```bash
+# <100ms lock, instant snapshot, stream to cloud
+dbbackup backup --engine=snapshot --snapshot-backend=lvm
+```
+
+### Continuous Binlog/WAL Streaming
+```bash
+# Real-time capture to S3 - sub-second RPO
+dbbackup binlog stream --target=s3://bucket/binlogs/
+```
+
+### Parallel Cloud Upload
+```bash
+# Saturate your network, not your patience
+dbbackup backup --engine=streaming --parallel-workers=8
+```
+
+## Real Numbers
+
+**100GB MySQL database:**
+
+| Metric | Veeam | Borg + Scripts | dbbackup |
+|--------|-------|----------------|----------|
+| Backup time | 45 min | 50 min | **12 min** |
+| Local disk needed | 100GB | 100GB | **0 GB** |
+| Recovery point | Daily | Daily | **< 1 second** |
+| Setup time | Days | Hours | **Minutes** |
+| Annual cost | $5,000+ | $0 + time | **$0** |
+
+## Migration Path
+
+### From Veeam
+```bash
+# Day 1: Test alongside existing
+dbbackup backup single mydb --cloud s3://test-bucket/
+
+# Week 1: Compare backup times, storage costs
+# Week 2: Switch primary backups
+# Month 1: Cancel renewal, buy your team pizza
+```
+
+### From Borg/Restic
+```bash
+# Day 1: Replace your wrapper scripts
+dbbackup dedup backup /var/lib/mysql/dumps/mydb.sql
+
+# Day 2: Add PITR
+dbbackup binlog stream --target=/mnt/nfs/binlogs/
+
+# Day 3: Delete 500 lines of bash
+```
+
+## The Commands You Need
+
+```bash
+# Deduplicated backups (Borg-style)
+dbbackup dedup backup <file>
+dbbackup dedup restore <id> <output>
+dbbackup dedup stats
+dbbackup dedup gc
+
+# Database-native backups
+dbbackup backup single <database>
+dbbackup backup all
+dbbackup restore <backup-file>
+
+# Point-in-time recovery
+dbbackup binlog stream
+dbbackup pitr restore --target-time "2026-01-12 14:30:00"
+
+# Cloud targets
+--cloud s3://bucket/path/
+--cloud gs://bucket/path/
+--cloud azure://container/path/
+```
+
+## Who Should Switch
+
+✅ **From Veeam/Commvault**: Same capabilities, zero license fees  
+✅ **From Borg/Restic**: Native database support, no wrapper scripts  
+✅ **From "homegrown scripts"**: Production-ready, battle-tested  
+✅ **Cloud-native deployments**: Kubernetes, ECS, Cloud Run ready  
+✅ **Compliance requirements**: AES-256-GCM, audit logging  
+
+## Get Started
+
+```bash
+# Download (single binary, ~48MB static linked)
+curl -LO https://github.com/PlusOne/dbbackup/releases/latest/download/dbbackup_linux_amd64
+chmod +x dbbackup_linux_amd64
+
+# Your first deduplicated backup
+./dbbackup_linux_amd64 dedup backup /var/lib/mysql/dumps/production.sql
+
+# Your first cloud backup  
+./dbbackup_linux_amd64 backup single production \
+  --db-type mysql \
+  --cloud s3://my-backups/
+```
+
+## The Bottom Line
+
+| Solution | What It Costs You |
+|----------|-------------------|
+| Veeam | Money |
+| Borg/Restic | Time (scripting, integration) |
+| dbbackup | **Neither** |
+
+**This is what open source really means.**
+
+Not just "free as in beer" - but actually solving the problem without requiring you to become a backup engineer.
+
+---
+
+*Apache 2.0 Licensed. Free forever. No sales calls. No wrapper scripts.*
+
+[GitHub](https://github.com/PlusOne/dbbackup) | [Releases](https://github.com/PlusOne/dbbackup/releases) | [Changelog](CHANGELOG.md)

PITR.md

@@ -584,100 +584,6 @@ Document your recovery procedure:
 9. Create new base backup
 ```
 
-## Large Database Support (600+ GB)
-
-For databases larger than 600 GB, PITR is the **recommended approach** over full dump/restore.
-
-### Why PITR Works Better for Large DBs
-
-| Approach | 600 GB Database | Recovery Time (RTO) |
-|----------|-----------------|---------------------|
-| Full pg_dump/restore | Hours to dump, hours to restore | 4-12+ hours |
-| PITR (base + WAL) | Incremental WAL only | 30 min - 2 hours |
-
-### Setup for Large Databases
-
-**1. Enable WAL archiving with compression:**
-```bash
-dbbackup pitr enable --archive-dir /backups/wal_archive --compress
-```
-
-**2. Take ONE base backup weekly/monthly (use pg_basebackup):**
-```bash
-# For 600+ GB, use fast checkpoint to minimize impact
-pg_basebackup -D /backups/base_$(date +%Y%m%d).tar.gz \
-  -Ft -z -P --checkpoint=fast --wal-method=none
-
-# Duration: 2-6 hours for 600 GB, but only needed weekly/monthly
-```
-
-**3. WAL files archive continuously** (~1-5 GB/hour typical), capturing every change.
-
-**4. Recover to any point in time:**
-```bash
-dbbackup restore pitr \
-  --base-backup /backups/base_20260101.tar.gz \
-  --wal-archive /backups/wal_archive \
-  --target-time "2026-01-13 14:30:00" \
-  --target-dir /var/lib/postgresql/16/restored
-```
-
-### PostgreSQL Optimizations for 600+ GB
-
-| Setting | Value | Purpose |
-|---------|-------|---------|
-| `wal_compression = on` | postgresql.conf | 70-80% smaller WAL files |
-| `max_wal_size = 4GB` | postgresql.conf | Reduce checkpoint frequency |
-| `checkpoint_timeout = 30min` | postgresql.conf | Less frequent checkpoints |
-| `archive_timeout = 300` | postgresql.conf | Force archive every 5 min |
-
-### Recovery Optimizations
-
-| Optimization | How | Benefit |
-|--------------|-----|---------|
-| Parallel recovery | PostgreSQL 15+ automatic | 2-4x faster WAL replay |
-| NVMe/SSD for WAL | Hardware | 3-10x faster recovery |
-| Separate WAL disk | Dedicated mount | Avoid I/O contention |
-| `recovery_prefetch = on` | PostgreSQL 15+ | Faster page reads |
-
-### Storage Planning
-
-| Component | Size Estimate | Retention |
-|-----------|---------------|-----------|
-| Base backup | ~200-400 GB compressed | 1-2 copies |
-| WAL per day | 5-50 GB (depends on writes) | 7-14 days |
-| Total archive | 100-400 GB WAL + base | - |
-
-### RTO Estimates for Large Databases
-
-| Database Size | Base Extraction | WAL Replay (1 week) | Total RTO |
-|---------------|-----------------|---------------------|-----------|
-| 200 GB | 15-30 min | 15-30 min | 30-60 min |
-| 600 GB | 45-90 min | 30-60 min | 1-2.5 hours |
-| 1 TB | 60-120 min | 45-90 min | 2-3.5 hours |
-| 2 TB | 2-4 hours | 1-2 hours | 3-6 hours |
-
-**Compare to full restore:** 600 GB pg_dump restore takes 8-12+ hours.
-
-### Best Practices for 600+ GB
-
-1. **Weekly base backups** - Monthly if storage is tight
-2. **Test recovery monthly** - Verify WAL chain integrity
-3. **Monitor WAL lag** - Alert if archive falls behind
-4. **Use streaming replication** - For HA, combine with PITR for DR
-5. **Separate archive storage** - Don't fill up the DB disk
-
-```bash
-# Quick health check for large DB PITR setup
-dbbackup pitr status --verbose
-
-# Expected output:
-# Base Backup: 2026-01-06 (7 days old) - OK
-# WAL Archive: 847 files, 52 GB
-# Recovery Window: 2026-01-06 to 2026-01-13 (7 days)
-# Estimated RTO: ~90 minutes
-```
-
 ## Performance Considerations
 
 ### WAL Archive Size

README.md

@@ -4,43 +4,12 @@ Database backup and restore utility for PostgreSQL, MySQL, and MariaDB.
 
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Go Version](https://img.shields.io/badge/Go-1.21+-00ADD8?logo=go)](https://golang.org/)
-[![Release](https://img.shields.io/badge/Release-v5.7.10-green.svg)](https://git.uuxo.net/UUXO/dbbackup/releases/latest)
 
 **Repository:** https://git.uuxo.net/UUXO/dbbackup  
 **Mirror:** https://github.com/PlusOne/dbbackup
 
-## Quick Start (30 seconds)
-
-```bash
-# Download
-wget https://github.com/PlusOne/dbbackup/releases/latest/download/dbbackup-linux-amd64
-chmod +x dbbackup-linux-amd64
-
-# Backup your database
-./dbbackup-linux-amd64 backup single mydb --db-type postgres
-# Or for MySQL
-./dbbackup-linux-amd64 backup single mydb --db-type mysql --user root
-
-# Interactive mode (recommended for first-time users)
-./dbbackup-linux-amd64 interactive
-```
-
-**That's it!** Backups are stored in `./backups/` by default. See [QUICK.md](QUICK.md) for more real-world examples.
-
 ## Features
 
-### NEW in 5.0: We Built Our Own Database Engines
-
-**This is a really big step.** We're no longer calling external tools - **we built our own machines.**
-
-- **Our Own Engines**: Pure Go implementation - we speak directly to databases using their native wire protocols
-- **No External Tools**: Goodbye pg_dump, mysqldump, pg_restore, mysql, psql, mysqlbinlog - we don't need them anymore
-- **Native Protocol**: Direct PostgreSQL (pgx) and MySQL (go-sql-driver) communication - no shell, no pipes, no parsing
-- **Full Control**: Our code generates the SQL, handles the types, manages the connections
-- **Production Ready**: Advanced data type handling, proper escaping, binary support, batch processing
-
-### Core Database Features
-
 - Multi-database support: PostgreSQL, MySQL, MariaDB
 - Backup modes: Single database, cluster, sample data
 - **Dry-run mode**: Preflight checks before backup execution
@@ -58,17 +27,12 @@ chmod +x dbbackup-linux-amd64
 ### Enterprise DBA Features
 
 - **Backup Catalog**: SQLite-based catalog tracking all backups with gap detection
-- **Catalog Dashboard**: Interactive TUI for browsing and managing backups
 - **DR Drill Testing**: Automated disaster recovery testing in Docker containers
 - **Smart Notifications**: Batched alerts with escalation policies
-- **Progress Webhooks**: Real-time backup/restore progress notifications
 - **Compliance Reports**: SOC2, GDPR, HIPAA, PCI-DSS, ISO27001 report generation
 - **RTO/RPO Calculator**: Recovery objective analysis and recommendations
 - **Replica-Aware Backup**: Automatic backup from replicas to reduce primary load
 - **Parallel Table Backup**: Concurrent table dumps for faster backups
-- **Retention Simulator**: Preview retention policy effects before applying
-- **Cross-Region Sync**: Sync backups between cloud regions for disaster recovery
-- **Encryption Key Rotation**: Secure key management with rotation support
 
 ## Installation
 
@@ -92,7 +56,7 @@ Download from [releases](https://git.uuxo.net/UUXO/dbbackup/releases):
 
 ```bash
 # Linux x86_64
-wget https://git.uuxo.net/UUXO/dbbackup/releases/download/v5.7.10/dbbackup-linux-amd64
+wget https://git.uuxo.net/UUXO/dbbackup/releases/download/v3.42.1/dbbackup-linux-amd64
 chmod +x dbbackup-linux-amd64
 sudo mv dbbackup-linux-amd64 /usr/local/bin/dbbackup
 ```
@@ -115,9 +79,8 @@ go build
 # PostgreSQL with peer authentication
 sudo -u postgres dbbackup interactive
 
-# MySQL/MariaDB (use MYSQL_PWD env var for password)
-export MYSQL_PWD='secret'
-dbbackup interactive --db-type mysql --user root
+# MySQL/MariaDB
+dbbackup interactive --db-type mysql --user root --password secret
 ```
 
 **Main Menu:**
@@ -136,7 +99,6 @@ Database: postgres@localhost:5432 (PostgreSQL)
   Diagnose Backup File
   List & Manage Backups
   ────────────────────────────────
-  Tools
   View Active Operations
   Show Operation History
   Database Status & Health Check
@@ -145,22 +107,6 @@ Database: postgres@localhost:5432 (PostgreSQL)
   Quit
 ```
 
-**Tools Menu:**
-```
-Tools
-
-Advanced utilities for database backup management
-
-> Blob Statistics
-  Blob Extract (externalize LOBs)
-  ────────────────────────────────
-  Dedup Store Analyze
-  Verify Backup Integrity
-  Catalog Sync
-  ────────────────────────────────
-  Back to Main Menu
-```
-
 **Database Selection:**
 ```
 Single Database Backup
@@ -248,59 +194,21 @@ r: Restore | v: Verify | i: Info | d: Diagnose | D: Delete | R: Refresh | Esc: B
 ```
 Configuration Settings
 
-[SYSTEM] Detected Resources
-  CPU: 8 physical cores, 16 logical cores
-  Memory: 32GB total, 28GB available
-  Recommended Profile: balanced
-    → 8 cores and 32GB RAM supports moderate parallelism
-
-[CONFIG] Current Settings
-  Target DB: PostgreSQL (postgres)
-  Database: postgres@localhost:5432
-  Backup Dir: /var/backups/postgres
-  Compression: Level 6
-  Profile: balanced | Cluster: 2 parallel | Jobs: 4
-
 > Database Type: postgres
   CPU Workload Type: balanced
-  Resource Profile: balanced (P:2 J:4)
-  Cluster Parallelism: 2
-  Backup Directory: /var/backups/postgres
-  Work Directory: (system temp)
+  Backup Directory: /root/db_backups
+  Work Directory: /tmp
   Compression Level: 6
-  Parallel Jobs: 4
-  Dump Jobs: 4
+  Parallel Jobs: 16
+  Dump Jobs: 8
   Database Host: localhost
   Database Port: 5432
-  Database User: postgres
+  Database User: root
   SSL Mode: prefer
 
-[KEYS]  ↑↓ navigate | Enter edit | 'l' toggle LargeDB | 'c' conservative | 'p' recommend | 's' save | 'q' menu
+s: Save | r: Reset | q: Menu
 ```
 
-**Resource Profiles for Large Databases:**
-
-When restoring large databases on VMs with limited resources, use the resource profile settings to prevent "out of shared memory" errors:
-
-| Profile | Cluster Parallel | Jobs | Best For |
-|---------|------------------|------|----------|
-| conservative | 1 | 1 | Small VMs (<16GB RAM) |
-| balanced | 2 | 2-4 | Medium VMs (16-32GB RAM) |
-| performance | 4 | 4-8 | Large servers (32GB+ RAM) |
-| max-performance | 8 | 8-16 | High-end servers (64GB+) |
-
-**Large DB Mode:** Toggle with `l` key. Reduces parallelism by 50% and sets max_locks_per_transaction=8192 for complex databases with many tables/LOBs.
-
-**Quick shortcuts:** Press `l` to toggle Large DB Mode, `c` for conservative, `p` to show recommendation.
-
-**Troubleshooting Tools:**
-
-For PostgreSQL restore issues ("out of shared memory" errors), diagnostic scripts are available:
-- **diagnose_postgres_memory.sh** - Comprehensive system memory, PostgreSQL configuration, and resource analysis
-- **fix_postgres_locks.sh** - Automatically increase max_locks_per_transaction to 4096
-
-See [RESTORE_PROFILES.md](RESTORE_PROFILES.md) for detailed troubleshooting guidance.
-
 **Database Status:**
 ```
 Database Status & Health Check
@@ -340,21 +248,12 @@ dbbackup restore single backup.dump --target myapp_db --create --confirm
 # Restore cluster
 dbbackup restore cluster cluster_backup.tar.gz --confirm
 
-# Restore with resource profile (for resource-constrained servers)
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-
 # Restore with debug logging (saves detailed error report on failure)
 dbbackup restore cluster backup.tar.gz --save-debug-log /tmp/restore-debug.json --confirm
 
 # Diagnose backup before restore
 dbbackup restore diagnose backup.dump.gz --deep
 
-# Check PostgreSQL lock configuration (preflight for large restores)
-# - warns/fails when `max_locks_per_transaction` is insufficient and prints exact remediation
-# - safe to run before a restore to determine whether single-threaded restore is required
-# Example:
-# dbbackup verify-locks
-
 # Cloud backup
 dbbackup backup single mydb --cloud s3://my-bucket/backups/
 
@@ -374,7 +273,6 @@ dbbackup backup single mydb --dry-run
 | `restore pitr` | Point-in-Time Recovery |
 | `restore diagnose` | Diagnose backup file integrity |
 | `verify-backup` | Verify backup integrity |
-| `verify-locks` | Check PostgreSQL lock settings and get restore guidance |
 | `cleanup` | Remove old backups |
 | `status` | Check connection status |
 | `preflight` | Run pre-backup checks |
@@ -388,7 +286,6 @@ dbbackup backup single mydb --dry-run
 | `drill` | DR drill testing |
 | `report` | Compliance report generation |
 | `rto` | RTO/RPO analysis |
-| `blob stats` | Analyze blob/bytea columns in database |
 | `install` | Install as systemd service |
 | `uninstall` | Remove systemd service |
 | `metrics export` | Export Prometheus metrics to textfile |
@@ -402,11 +299,10 @@ dbbackup backup single mydb --dry-run
 | `--host` | Database host | localhost |
 | `--port` | Database port | 5432/3306 |
 | `--user` | Database user | current user |
-| `MYSQL_PWD` / `PGPASSWORD` | Database password (env var) | - |
+| `--password` | Database password | - |
 | `--backup-dir` | Backup directory | ~/db_backups |
 | `--compression` | Compression level (0-9) | 6 |
 | `--jobs` | Parallel jobs | 8 |
-| `--profile` | Resource profile (conservative/balanced/aggressive) | balanced |
 | `--cloud` | Cloud storage URI | - |
 | `--encrypt` | Enable encryption | false |
 | `--dry-run, -n` | Run preflight checks only | false |
@@ -548,13 +444,13 @@ dbbackup backup cluster -n  # Short flag
 
   Checks:
   ─────────────────────────────────────────────────────────────
-  Database Connectivity: Connected successfully
-  Required Tools:        pg_dump 15.4 available
-  Storage Target:        /backups writable (45 GB free)
-  Size Estimation:       ~2.5 GB required
+  ✅ Database Connectivity: Connected successfully
+  ✅ Required Tools:        pg_dump 15.4 available
+  ✅ Storage Target:        /backups writable (45 GB free)
+  ✅ Size Estimation:       ~2.5 GB required
   ─────────────────────────────────────────────────────────────
 
-  All checks passed
+  ✅ All checks passed
 
   Ready to backup. Remove --dry-run to execute.
 ```
@@ -586,24 +482,24 @@ dbbackup restore diagnose cluster_backup.tar.gz --deep
 
 **Example output:**
 ```
-Backup Diagnosis Report
+🔍 Backup Diagnosis Report
 ══════════════════════════════════════════════════════════════
 
 📁 File: mydb_20260105.dump.gz
    Format: PostgreSQL Custom (gzip)
    Size: 2.5 GB
 
-Analysis Results:
-   Gzip integrity: Valid
-   PGDMP signature: Valid
-   pg_restore --list: Success (245 objects)
-   COPY block check: TRUNCATED
+🔬 Analysis Results:
+   ✅ Gzip integrity: Valid
+   ✅ PGDMP signature: Valid
+   ✅ pg_restore --list: Success (245 objects)
+   ❌ COPY block check: TRUNCATED
 
-Issues Found:
+⚠️  Issues Found:
    - COPY block for table 'orders' not terminated
    - Dump appears truncated at line 1,234,567
 
-Recommendations:
+💡 Recommendations:
    - Re-run the backup for this database
    - Check disk space on backup server
    - Verify network stability during backup
@@ -661,7 +557,7 @@ dbbackup backup single mydb
     "backup_size": 2684354560,
     "hostname": "db-server-01"
   },
-  "subject": "[dbbackup] Backup Completed: mydb"
+  "subject": "✅ [dbbackup] Backup Completed: mydb"
 }
 ```
 
@@ -674,22 +570,6 @@ dbbackup backup single mydb
 - `dr_drill_passed`, `dr_drill_failed`
 - `gap_detected`, `rpo_violation`
 
-### Testing Notifications
-
-```bash
-# Test notification configuration
-export NOTIFY_SMTP_HOST="localhost"
-export NOTIFY_SMTP_PORT="25"
-export NOTIFY_SMTP_FROM="dbbackup@myserver.local"
-export NOTIFY_SMTP_TO="admin@example.com"
-
-dbbackup notify test --verbose
-# [OK] Notification sent successfully
-
-# For servers using STARTTLS with self-signed certs
-export NOTIFY_SMTP_STARTTLS="false"
-```
-
 ## Backup Catalog
 
 Track all backups in a SQLite catalog with gap detection and search:
@@ -707,87 +587,13 @@ dbbackup catalog stats
 # Detect backup gaps (missing scheduled backups)
 dbbackup catalog gaps --interval 24h --database mydb
 
-# Search backups by date range
-dbbackup catalog search --database mydb --after 2024-01-01 --before 2024-12-31
+# Search backups
+dbbackup catalog search --database mydb --start 2024-01-01 --end 2024-12-31
 
-# Get backup info by path
-dbbackup catalog info /backups/mydb_20240115.dump.gz
-
-# Compare two backups to see what changed
-dbbackup diff /backups/mydb_20240115.dump.gz /backups/mydb_20240120.dump.gz
-
-# Compare using catalog IDs
-dbbackup diff 123 456
-
-# Compare latest two backups for a database
-dbbackup diff mydb:latest mydb:previous
+# Get backup info
+dbbackup catalog info 42
 ```
 
-## Cost Analysis
-
-Analyze and optimize cloud storage costs:
-
-```bash
-# Analyze current backup costs
-dbbackup cost analyze
-
-# Specific database
-dbbackup cost analyze --database mydb
-
-# Compare providers and tiers
-dbbackup cost analyze --provider aws --format table
-
-# Get JSON for automation/reporting
-dbbackup cost analyze --format json
-```
-
-**Providers analyzed:**
-- AWS S3 (Standard, IA, Glacier, Deep Archive)
-- Google Cloud Storage (Standard, Nearline, Coldline, Archive)
-- Azure Blob (Hot, Cool, Archive)
-- Backblaze B2
-- Wasabi
-
-Shows tiered storage strategy recommendations with potential annual savings.
-
-## Health Check
-
-Comprehensive backup infrastructure health monitoring:
-
-```bash
-# Quick health check
-dbbackup health
-
-# Detailed output
-dbbackup health --verbose
-
-# JSON for monitoring integration (Prometheus, Nagios, etc.)
-dbbackup health --format json
-
-# Custom backup interval for gap detection
-dbbackup health --interval 12h
-
-# Skip database connectivity (offline check)
-dbbackup health --skip-db
-```
-
-**Checks performed:**
-- Configuration validity
-- Database connectivity
-- Backup directory accessibility
-- Catalog integrity
-- Backup freshness (is last backup recent?)
-- Gap detection (missed scheduled backups)
-- Verification status (% of backups verified)
-- File integrity (do files exist and match metadata?)
-- Orphaned entries (catalog entries for missing files)
-- Disk space
-
-**Exit codes for automation:**
-- `0` = healthy (all checks passed)
-- `1` = warning (some checks need attention)
-- `2` = critical (immediate action required)
-
 ## DR Drill Testing
 
 Automated disaster recovery testing restores backups to Docker containers:
@@ -796,8 +602,8 @@ Automated disaster recovery testing restores backups to Docker containers:
 # Run full DR drill
 dbbackup drill run /backups/mydb_latest.dump.gz \
   --database mydb \
-  --type postgresql \
-  --timeout 1800
+  --db-type postgres \
+  --timeout 30m
 
 # Quick drill (restore + basic validation)
 dbbackup drill quick /backups/mydb_latest.dump.gz --database mydb
@@ -805,11 +611,11 @@ dbbackup drill quick /backups/mydb_latest.dump.gz --database mydb
 # List running drill containers
 dbbackup drill list
 
-# Cleanup all drill containers
-dbbackup drill cleanup
+# Cleanup old drill containers
+dbbackup drill cleanup --age 24h
 
-# Display a saved drill report
-dbbackup drill report drill_20240115_120000_report.json --format json
+# Generate drill report
+dbbackup drill report --format html --output drill-report.html
 ```
 
 **Drill phases:**
@@ -854,13 +660,16 @@ Calculate and monitor Recovery Time/Point Objectives:
 
 ```bash
 # Analyze RTO/RPO for a database
-dbbackup rto analyze --database mydb
+dbbackup rto analyze mydb
 
 # Show status for all databases
 dbbackup rto status
 
 # Check against targets
-dbbackup rto check --target-rto 4h --target-rpo 1h
+dbbackup rto check --rto 4h --rpo 1h
+
+# Set target objectives
+dbbackup rto analyze mydb --target-rto 4h --target-rpo 1h
 ```
 
 **Analysis includes:**
@@ -908,8 +717,6 @@ sudo dbbackup uninstall cluster --purge
 
 Export backup metrics for monitoring with Prometheus:
 
-> **Migration Note (v1.x → v2.x):** The `--instance` flag was renamed to `--server` to avoid collision with Prometheus's reserved `instance` label. Update your cronjobs and scripts accordingly.
-
 ### Textfile Collector
 
 For integration with node_exporter:
@@ -918,8 +725,8 @@ For integration with node_exporter:
 # Export metrics to textfile
 dbbackup metrics export --output /var/lib/node_exporter/textfile_collector/dbbackup.prom
 
-# Export for specific server
-dbbackup metrics export --server production --output /var/lib/dbbackup/metrics/production.prom
+# Export for specific instance
+dbbackup metrics export --instance production --output /var/lib/dbbackup/metrics/production.prom
 ```
 
 Configure node_exporter:
@@ -987,12 +794,8 @@ export PGPASSWORD=password
 ### MySQL/MariaDB Authentication
 
 ```bash
-# Environment variable (recommended)
-export MYSQL_PWD='secret'
-dbbackup backup single mydb --db-type mysql --user root
-
-# Socket authentication (no password needed)
-dbbackup backup single mydb --db-type mysql --socket /var/run/mysqld/mysqld.sock
+# Command line
+dbbackup backup single mydb --db-type mysql --user root --password secret
 
 # Configuration file
 cat > ~/.my.cnf << EOF
@@ -1003,9 +806,6 @@ EOF
 chmod 0600 ~/.my.cnf
 ```
 
-> **Note:** The `--password` command-line flag is not supported for security reasons
-> (passwords would be visible in `ps aux` output). Use environment variables or config files.
-
 ### Configuration Persistence
 
 Settings are saved to `.dbbackup.conf` in the current directory:
@@ -1058,27 +858,15 @@ Workload types:
 
 ## Documentation
 
-**Guides:**
-- [QUICK.md](QUICK.md) - Real-world examples cheat sheet
-- [docs/PITR.md](docs/PITR.md) - Point-in-Time Recovery (PostgreSQL)
-- [docs/MYSQL_PITR.md](docs/MYSQL_PITR.md) - Point-in-Time Recovery (MySQL)
-- [docs/ENGINES.md](docs/ENGINES.md) - Database engine configuration
-- [docs/RESTORE_PROFILES.md](docs/RESTORE_PROFILES.md) - Restore resource profiles
-
-**Cloud Storage:**
-- [docs/CLOUD.md](docs/CLOUD.md) - Cloud storage overview
-- [docs/AZURE.md](docs/AZURE.md) - Azure Blob Storage
-- [docs/GCS.md](docs/GCS.md) - Google Cloud Storage
-
-**Deployment:**
-- [docs/DOCKER.md](docs/DOCKER.md) - Docker deployment
-- [docs/SYSTEMD.md](docs/SYSTEMD.md) - Systemd installation & scheduling
-
-**Reference:**
+- [SYSTEMD.md](SYSTEMD.md) - Systemd installation & scheduling
+- [DOCKER.md](DOCKER.md) - Docker deployment
+- [CLOUD.md](CLOUD.md) - Cloud storage configuration
+- [PITR.md](PITR.md) - Point-in-Time Recovery
+- [AZURE.md](AZURE.md) - Azure Blob Storage
+- [GCS.md](GCS.md) - Google Cloud Storage
 - [SECURITY.md](SECURITY.md) - Security considerations
 - [CONTRIBUTING.md](CONTRIBUTING.md) - Contribution guidelines
 - [CHANGELOG.md](CHANGELOG.md) - Version history
-- [docs/LOCK_DEBUGGING.md](docs/LOCK_DEBUGGING.md) - Lock troubleshooting
 
 ## License
 

RELEASE_NOTES.md

@@ -0,0 +1,108 @@
+# v3.42.1 Release Notes
+
+## What's New in v3.42.1
+
+### Deduplication - Resistance is Futile
+
+Content-defined chunking deduplication for space-efficient backups. Like restic/borgbackup but with **native database dump support**.
+
+```bash
+# First backup: 5MB stored
+dbbackup dedup backup mydb.dump
+
+# Second backup (modified): only 1.6KB new data stored!
+# 100% deduplication ratio
+dbbackup dedup backup mydb_modified.dump
+```
+
+#### Features
+- **Gear Hash CDC** - Content-defined chunking with 92%+ overlap on shifted data
+- **SHA-256 Content-Addressed** - Chunks stored by hash, automatic deduplication
+- **AES-256-GCM Encryption** - Optional per-chunk encryption
+- **Gzip Compression** - Optional compression (enabled by default)
+- **SQLite Index** - Fast chunk lookups and statistics
+
+#### Commands
+```bash
+dbbackup dedup backup <file>              # Create deduplicated backup
+dbbackup dedup backup <file> --encrypt    # With AES-256-GCM encryption
+dbbackup dedup restore <id> <output>      # Restore from manifest
+dbbackup dedup list                       # List all backups
+dbbackup dedup stats                      # Show deduplication statistics
+dbbackup dedup delete <id>                # Delete a backup
+dbbackup dedup gc                         # Garbage collect unreferenced chunks
+```
+
+#### Storage Structure
+```
+<backup-dir>/dedup/
+  chunks/           # Content-addressed chunk files
+    ab/cdef1234...  # Sharded by first 2 chars of hash
+  manifests/        # JSON manifest per backup
+  chunks.db         # SQLite index
+```
+
+### Also Included (from v3.41.x)
+- **Systemd Integration** - One-command install with `dbbackup install`
+- **Prometheus Metrics** - HTTP exporter on port 9399
+- **Backup Catalog** - SQLite-based tracking of all backup operations
+- **Prometheus Alerting Rules** - Added to SYSTEMD.md documentation
+
+### Installation
+
+#### Quick Install (Recommended)
+```bash
+# Download for your platform
+curl -LO https://git.uuxo.net/UUXO/dbbackup/releases/download/v3.42.1/dbbackup-linux-amd64
+
+# Install with systemd service
+chmod +x dbbackup-linux-amd64
+sudo ./dbbackup-linux-amd64 install --config /path/to/config.yaml
+```
+
+#### Available Binaries
+| Platform | Architecture | Binary |
+|----------|--------------|--------|
+| Linux | amd64 | `dbbackup-linux-amd64` |
+| Linux | arm64 | `dbbackup-linux-arm64` |
+| macOS | Intel | `dbbackup-darwin-amd64` |
+| macOS | Apple Silicon | `dbbackup-darwin-arm64` |
+| FreeBSD | amd64 | `dbbackup-freebsd-amd64` |
+
+### Systemd Commands
+```bash
+dbbackup install --config config.yaml   # Install service + timer
+dbbackup install --status               # Check service status
+dbbackup install --uninstall            # Remove services
+```
+
+### Prometheus Metrics
+Available at `http://localhost:9399/metrics`:
+
+| Metric | Description |
+|--------|-------------|
+| `dbbackup_last_backup_timestamp` | Unix timestamp of last backup |
+| `dbbackup_last_backup_success` | 1 if successful, 0 if failed |
+| `dbbackup_last_backup_duration_seconds` | Duration of last backup |
+| `dbbackup_last_backup_size_bytes` | Size of last backup |
+| `dbbackup_backup_total` | Total number of backups |
+| `dbbackup_backup_errors_total` | Total number of failed backups |
+
+### Security Features
+- Hardened systemd service with `ProtectSystem=strict`
+- `NoNewPrivileges=true` prevents privilege escalation
+- Dedicated `dbbackup` system user (optional)
+- Credential files with restricted permissions
+
+### Documentation
+- [SYSTEMD.md](SYSTEMD.md) - Complete systemd installation guide
+- [README.md](README.md) - Full documentation
+- [CHANGELOG.md](CHANGELOG.md) - Version history
+
+### Bug Fixes
+- Fixed SQLite time parsing in dedup stats
+- Fixed function name collision in cmd package
+
+---
+
+**Full Changelog**: https://git.uuxo.net/UUXO/dbbackup/compare/v3.41.1...v3.42.1

SECURITY.md

@@ -6,10 +6,9 @@ We release security updates for the following versions:
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 5.7.x   | :white_check_mark: |
-| 5.6.x   | :white_check_mark: |
-| 5.5.x   | :white_check_mark: |
-| < 5.5   | :x:                |
+| 3.1.x   | :white_check_mark: |
+| 3.0.x   | :white_check_mark: |
+| < 3.0   | :x:                |
 
 ## Reporting a Vulnerability
 
@@ -65,32 +64,32 @@ We release security updates for the following versions:
 ### For Users
 
 **Encryption Keys:**
-- - RECOMMENDED: Generate strong 32-byte keys: `head -c 32 /dev/urandom | base64 > key.file`
-- - RECOMMENDED: Store keys securely (KMS, HSM, or encrypted filesystem)
-- - RECOMMENDED: Use unique keys per environment
-- - AVOID: Never commit keys to version control
-- - AVOID: Never share keys over unencrypted channels
+- ✅ Generate strong 32-byte keys: `head -c 32 /dev/urandom | base64 > key.file`
+- ✅ Store keys securely (KMS, HSM, or encrypted filesystem)
+- ✅ Use unique keys per environment
+- ❌ Never commit keys to version control
+- ❌ Never share keys over unencrypted channels
 
 **Database Credentials:**
-- - RECOMMENDED: Use read-only accounts for backups when possible
-- - RECOMMENDED: Rotate credentials regularly
-- - RECOMMENDED: Use environment variables or secure config files
-- - AVOID: Never hardcode credentials in scripts
-- - AVOID: Avoid using root/admin accounts
+- ✅ Use read-only accounts for backups when possible
+- ✅ Rotate credentials regularly
+- ✅ Use environment variables or secure config files
+- ❌ Never hardcode credentials in scripts
+- ❌ Avoid using root/admin accounts
 
 **Backup Storage:**
-- - RECOMMENDED: Encrypt backups with `--encrypt` flag
-- - RECOMMENDED: Use secure cloud storage with encryption at rest
-- - RECOMMENDED: Implement proper access controls (IAM, ACLs)
-- - RECOMMENDED: Enable backup retention and versioning
-- - AVOID: Never store unencrypted backups on public storage
+- ✅ Encrypt backups with `--encrypt` flag
+- ✅ Use secure cloud storage with encryption at rest
+- ✅ Implement proper access controls (IAM, ACLs)
+- ✅ Enable backup retention and versioning
+- ❌ Never store unencrypted backups on public storage
 
 **Docker Usage:**
-- - RECOMMENDED: Use specific version tags (`:v3.2.0` not `:latest`)
-- - RECOMMENDED: Run as non-root user (default in our image)
-- - RECOMMENDED: Mount volumes read-only when possible
-- - RECOMMENDED: Use Docker secrets for credentials
-- - AVOID: Don't run with `--privileged` unless necessary
+- ✅ Use specific version tags (`:v3.2.0` not `:latest`)
+- ✅ Run as non-root user (default in our image)
+- ✅ Mount volumes read-only when possible
+- ✅ Use Docker secrets for credentials
+- ❌ Don't run with `--privileged` unless necessary
 
 ### For Developers
 
@@ -152,7 +151,7 @@ We release security updates for the following versions:
 
 | Date       | Auditor          | Scope                    | Status |
 |------------|------------------|--------------------------|--------|
-| 2025-11-26 | Internal Review  | Initial release audit    | - RECOMMENDED: Pass |
+| 2025-11-26 | Internal Review  | Initial release audit    | ✅ Pass |
 
 ## Vulnerability Disclosure Policy
 

bin/README.md

@@ -0,0 +1,87 @@
+# DB Backup Tool - Pre-compiled Binaries
+
+This directory contains pre-compiled binaries for the DB Backup Tool across multiple platforms and architectures.
+
+## Build Information
+- **Version**: 3.42.10
+- **Build Time**: 2026-01-12_14:25:53_UTC
+- **Git Commit**: d19c065
+
+## Recent Updates (v1.1.0)
+- ✅ Fixed TUI progress display with line-by-line output
+- ✅ Added interactive configuration settings menu
+- ✅ Improved menu navigation and responsiveness  
+- ✅ Enhanced completion status handling
+- ✅ Better CPU detection and optimization
+- ✅ Silent mode support for TUI operations
+
+## Available Binaries
+
+### Linux
+- `dbbackup_linux_amd64` - Linux 64-bit (Intel/AMD)
+- `dbbackup_linux_arm64` - Linux 64-bit (ARM)
+- `dbbackup_linux_arm_armv7` - Linux 32-bit (ARMv7)
+
+### macOS
+- `dbbackup_darwin_amd64` - macOS 64-bit (Intel)
+- `dbbackup_darwin_arm64` - macOS 64-bit (Apple Silicon)
+
+### Windows
+- `dbbackup_windows_amd64.exe` - Windows 64-bit (Intel/AMD)
+- `dbbackup_windows_arm64.exe` - Windows 64-bit (ARM)
+
+### BSD Systems
+- `dbbackup_freebsd_amd64` - FreeBSD 64-bit
+- `dbbackup_openbsd_amd64` - OpenBSD 64-bit
+- `dbbackup_netbsd_amd64` - NetBSD 64-bit
+
+## Usage
+
+1. Download the appropriate binary for your platform
+2. Make it executable (Unix-like systems): `chmod +x dbbackup_*`
+3. Run: `./dbbackup_* --help`
+
+## Interactive Mode
+
+Launch the interactive TUI menu for easy configuration and operation:
+
+```bash
+# Interactive mode with TUI menu
+./dbbackup_linux_amd64
+
+# Features:
+# - Interactive configuration settings
+# - Real-time progress display
+# - Operation history and status
+# - CPU detection and optimization
+```
+
+## Command Line Mode
+
+Direct command line usage with line-by-line progress:
+
+```bash
+# Show CPU information and optimization settings
+./dbbackup_linux_amd64 cpu
+
+# Auto-optimize for your hardware
+./dbbackup_linux_amd64 backup cluster --auto-detect-cores
+
+# Manual CPU configuration  
+./dbbackup_linux_amd64 backup single mydb --jobs 8 --dump-jobs 4
+
+# Line-by-line progress output
+./dbbackup_linux_amd64 backup cluster --progress-type line
+```
+
+## CPU Detection
+
+All binaries include advanced CPU detection capabilities:
+- Automatic core detection for optimal parallelism
+- Support for different workload types (CPU-intensive, I/O-intensive, balanced)
+- Platform-specific optimizations for Linux, macOS, and Windows
+- Interactive CPU configuration in TUI mode
+
+## Support
+
+For issues or questions, please refer to the main project documentation.

build_all.sh

@@ -33,7 +33,7 @@ CYAN='\033[0;36m'
 BOLD='\033[1m'
 NC='\033[0m'
 
-# Platform configurations - Linux & macOS only
+# Platform configurations
 # Format: "GOOS/GOARCH:binary_suffix:description"
 PLATFORMS=(
     "linux/amd64::Linux 64-bit (Intel/AMD)"
@@ -41,6 +41,11 @@ PLATFORMS=(
     "linux/arm:_armv7:Linux 32-bit (ARMv7)"
     "darwin/amd64::macOS 64-bit (Intel)"
     "darwin/arm64::macOS 64-bit (Apple Silicon)"
+    "windows/amd64:.exe:Windows 64-bit (Intel/AMD)"
+    "windows/arm64:.exe:Windows 64-bit (ARM)"
+    "freebsd/amd64::FreeBSD 64-bit (Intel/AMD)"
+    "openbsd/amd64::OpenBSD 64-bit (Intel/AMD)"
+    "netbsd/amd64::NetBSD 64-bit (Intel/AMD)"
 )
 
 echo -e "${BOLD}${BLUE}🔨 Cross-Platform Build Script for ${APP_NAME}${NC}"

cmd/backup.go

@@ -34,16 +34,8 @@ Examples:
 var clusterCmd = &cobra.Command{
 	Use:   "cluster",
 	Short: "Create full cluster backup (PostgreSQL only)",
-	Long: `Create a complete backup of the entire PostgreSQL cluster including all databases and global objects (roles, tablespaces, etc.).
-
-Native Engine:
-  --native           - Use pure Go native engine (SQL format, no pg_dump required)
-  --fallback-tools   - Fall back to external tools if native engine fails
-
-By default, cluster backup uses PostgreSQL custom format (.dump) for efficiency.
-With --native, all databases are backed up in SQL format (.sql.gz) using the 
-native Go engine, eliminating the need for pg_dump.`,
-	Args: cobra.NoArgs,
+	Long:  `Create a complete backup of the entire PostgreSQL cluster including all databases and global objects (roles, tablespaces, etc.)`,
+	Args:  cobra.NoArgs,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		return runClusterBackup(cmd.Context())
 	},
@@ -59,9 +51,6 @@ var (
 	backupDryRun      bool
 )
 
-// Note: nativeAutoProfile, nativeWorkers, nativePoolSize, nativeBufferSizeKB, nativeBatchSize
-// are defined in native_backup.go
-
 var singleCmd = &cobra.Command{
 	Use:   "single [database]",
 	Short: "Create single database backup",
@@ -69,13 +58,13 @@ var singleCmd = &cobra.Command{
 
 Backup Types:
   --backup-type full         - Complete full backup (default)
-  --backup-type incremental  - Incremental backup (only changed files since base)
+  --backup-type incremental  - Incremental backup (only changed files since base) [NOT IMPLEMENTED]
 
 Examples:
   # Full backup (default)
   dbbackup backup single mydb
   
-  # Incremental backup (requires previous full backup)
+  # Incremental backup (requires previous full backup) [COMING IN v2.2.1]
   dbbackup backup single mydb --backup-type incremental --base-backup mydb_20250126.tar.gz`,
 	Args: cobra.MaximumNArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
@@ -124,41 +113,8 @@ func init() {
 	backupCmd.AddCommand(singleCmd)
 	backupCmd.AddCommand(sampleCmd)
 
-	// Native engine flags for cluster backup
-	clusterCmd.Flags().Bool("native", false, "Use pure Go native engine (SQL format, no external tools)")
-	clusterCmd.Flags().Bool("fallback-tools", false, "Fall back to external tools if native engine fails")
-	clusterCmd.Flags().BoolVar(&nativeAutoProfile, "auto", true, "Auto-detect optimal settings based on system resources (default: true)")
-	clusterCmd.Flags().IntVar(&nativeWorkers, "workers", 0, "Number of parallel workers (0 = auto-detect)")
-	clusterCmd.Flags().IntVar(&nativePoolSize, "pool-size", 0, "Connection pool size (0 = auto-detect)")
-	clusterCmd.Flags().IntVar(&nativeBufferSizeKB, "buffer-size", 0, "Buffer size in KB (0 = auto-detect)")
-	clusterCmd.Flags().IntVar(&nativeBatchSize, "batch-size", 0, "Batch size for bulk operations (0 = auto-detect)")
-	clusterCmd.PreRunE = func(cmd *cobra.Command, args []string) error {
-		if cmd.Flags().Changed("native") {
-			native, _ := cmd.Flags().GetBool("native")
-			cfg.UseNativeEngine = native
-			if native {
-				log.Info("Native engine mode enabled for cluster backup - using SQL format")
-			}
-		}
-		if cmd.Flags().Changed("fallback-tools") {
-			fallback, _ := cmd.Flags().GetBool("fallback-tools")
-			cfg.FallbackToTools = fallback
-		}
-		if cmd.Flags().Changed("auto") {
-			nativeAutoProfile, _ = cmd.Flags().GetBool("auto")
-		}
-		return nil
-	}
-
-	// Add auto-profile flags to single backup too
-	singleCmd.Flags().BoolVar(&nativeAutoProfile, "auto", true, "Auto-detect optimal settings based on system resources")
-	singleCmd.Flags().IntVar(&nativeWorkers, "workers", 0, "Number of parallel workers (0 = auto-detect)")
-	singleCmd.Flags().IntVar(&nativePoolSize, "pool-size", 0, "Connection pool size (0 = auto-detect)")
-	singleCmd.Flags().IntVar(&nativeBufferSizeKB, "buffer-size", 0, "Buffer size in KB (0 = auto-detect)")
-	singleCmd.Flags().IntVar(&nativeBatchSize, "batch-size", 0, "Batch size for bulk operations (0 = auto-detect)")
-
 	// Incremental backup flags (single backup only) - using global vars to avoid initialization cycle
-	singleCmd.Flags().StringVar(&backupTypeFlag, "backup-type", "full", "Backup type: full or incremental")
+	singleCmd.Flags().StringVar(&backupTypeFlag, "backup-type", "full", "Backup type: full or incremental [incremental NOT IMPLEMENTED]")
 	singleCmd.Flags().StringVar(&baseBackupFlag, "base-backup", "", "Path to base backup (required for incremental)")
 
 	// Encryption flags for all backup commands
@@ -173,11 +129,6 @@ func init() {
 		cmd.Flags().BoolVarP(&backupDryRun, "dry-run", "n", false, "Validate configuration without executing backup")
 	}
 
-	// Verification flag for all backup commands (HIGH priority #9)
-	for _, cmd := range []*cobra.Command{clusterCmd, singleCmd, sampleCmd} {
-		cmd.Flags().Bool("no-verify", false, "Skip automatic backup verification after creation")
-	}
-
 	// Cloud storage flags for all backup commands
 	for _, cmd := range []*cobra.Command{clusterCmd, singleCmd, sampleCmd} {
 		cmd.Flags().String("cloud", "", "Cloud storage URI (e.g., s3://bucket/path) - takes precedence over individual flags")
@@ -233,12 +184,6 @@ func init() {
 				}
 			}
 
-			// Handle --no-verify flag (#9 Auto Backup Verification)
-			if c.Flags().Changed("no-verify") {
-				noVerify, _ := c.Flags().GetBool("no-verify")
-				cfg.VerifyAfterBackup = !noVerify
-			}
-
 			return nil
 		}
 	}

cmd/backup_diff.go

@@ -1,417 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"dbbackup/internal/catalog"
-	"dbbackup/internal/metadata"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	diffFormat   string
-	diffVerbose  bool
-	diffShowOnly string // changed, added, removed, all
-)
-
-// diffCmd compares two backups
-var diffCmd = &cobra.Command{
-	Use:   "diff <backup1> <backup2>",
-	Short: "Compare two backups and show differences",
-	Long: `Compare two backups from the catalog and show what changed.
-
-Shows:
-  - New tables/databases added
-  - Removed tables/databases
-  - Size changes for existing tables
-  - Total size delta
-  - Compression ratio changes
-
-Arguments can be:
-  - Backup file paths (absolute or relative)
-  - Backup IDs from catalog (e.g., "123", "456")
-  - Database name with latest backup (e.g., "mydb:latest")
-
-Examples:
-  # Compare two backup files
-  dbbackup diff backup1.dump.gz backup2.dump.gz
-
-  # Compare catalog entries by ID
-  dbbackup diff 123 456
-
-  # Compare latest two backups for a database
-  dbbackup diff mydb:latest mydb:previous
-
-  # Show only changes (ignore unchanged)
-  dbbackup diff backup1.dump.gz backup2.dump.gz --show changed
-
-  # JSON output for automation
-  dbbackup diff 123 456 --format json`,
-	Args: cobra.ExactArgs(2),
-	RunE: runDiff,
-}
-
-func init() {
-	rootCmd.AddCommand(diffCmd)
-
-	diffCmd.Flags().StringVar(&diffFormat, "format", "table", "Output format (table, json)")
-	diffCmd.Flags().BoolVar(&diffVerbose, "verbose", false, "Show verbose output")
-	diffCmd.Flags().StringVar(&diffShowOnly, "show", "all", "Show only: changed, added, removed, all")
-}
-
-func runDiff(cmd *cobra.Command, args []string) error {
-	backup1Path, err := resolveBackupArg(args[0])
-	if err != nil {
-		return fmt.Errorf("failed to resolve backup1: %w", err)
-	}
-
-	backup2Path, err := resolveBackupArg(args[1])
-	if err != nil {
-		return fmt.Errorf("failed to resolve backup2: %w", err)
-	}
-
-	// Load metadata for both backups
-	meta1, err := metadata.Load(backup1Path)
-	if err != nil {
-		return fmt.Errorf("failed to load metadata for backup1: %w", err)
-	}
-
-	meta2, err := metadata.Load(backup2Path)
-	if err != nil {
-		return fmt.Errorf("failed to load metadata for backup2: %w", err)
-	}
-
-	// Validate same database
-	if meta1.Database != meta2.Database {
-		return fmt.Errorf("backups are from different databases: %s vs %s", meta1.Database, meta2.Database)
-	}
-
-	// Calculate diff
-	diff := calculateBackupDiff(meta1, meta2)
-
-	// Output
-	if diffFormat == "json" {
-		return outputDiffJSON(diff, meta1, meta2)
-	}
-
-	return outputDiffTable(diff, meta1, meta2)
-}
-
-// resolveBackupArg resolves various backup reference formats
-func resolveBackupArg(arg string) (string, error) {
-	// If it looks like a file path, use it directly
-	if strings.Contains(arg, "/") || strings.HasSuffix(arg, ".gz") || strings.HasSuffix(arg, ".dump") {
-		if _, err := os.Stat(arg); err == nil {
-			return arg, nil
-		}
-		return "", fmt.Errorf("backup file not found: %s", arg)
-	}
-
-	// Try as catalog ID
-	cat, err := openCatalog()
-	if err != nil {
-		return "", fmt.Errorf("failed to open catalog: %w", err)
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Special syntax: "database:latest" or "database:previous"
-	if strings.Contains(arg, ":") {
-		parts := strings.Split(arg, ":")
-		database := parts[0]
-		position := parts[1]
-
-		query := &catalog.SearchQuery{
-			Database:  database,
-			OrderBy:   "created_at",
-			OrderDesc: true,
-		}
-
-		if position == "latest" {
-			query.Limit = 1
-		} else if position == "previous" {
-			query.Limit = 2
-		} else {
-			return "", fmt.Errorf("invalid position: %s (use 'latest' or 'previous')", position)
-		}
-
-		entries, err := cat.Search(ctx, query)
-		if err != nil {
-			return "", err
-		}
-
-		if len(entries) == 0 {
-			return "", fmt.Errorf("no backups found for database: %s", database)
-		}
-
-		if position == "previous" {
-			if len(entries) < 2 {
-				return "", fmt.Errorf("not enough backups for database: %s (need at least 2)", database)
-			}
-			return entries[1].BackupPath, nil
-		}
-
-		return entries[0].BackupPath, nil
-	}
-
-	// Try as numeric ID
-	var id int64
-	_, err = fmt.Sscanf(arg, "%d", &id)
-	if err == nil {
-		entry, err := cat.Get(ctx, id)
-		if err != nil {
-			return "", err
-		}
-		if entry == nil {
-			return "", fmt.Errorf("backup not found with ID: %d", id)
-		}
-		return entry.BackupPath, nil
-	}
-
-	return "", fmt.Errorf("invalid backup reference: %s", arg)
-}
-
-// BackupDiff represents the difference between two backups
-type BackupDiff struct {
-	Database      string
-	Backup1Time   time.Time
-	Backup2Time   time.Time
-	TimeDelta     time.Duration
-	SizeDelta     int64
-	SizeDeltaPct  float64
-	DurationDelta float64
-
-	// Detailed changes (when metadata contains table info)
-	AddedItems     []DiffItem
-	RemovedItems   []DiffItem
-	ChangedItems   []DiffItem
-	UnchangedItems []DiffItem
-}
-
-type DiffItem struct {
-	Name      string
-	Size1     int64
-	Size2     int64
-	SizeDelta int64
-	DeltaPct  float64
-}
-
-func calculateBackupDiff(meta1, meta2 *metadata.BackupMetadata) *BackupDiff {
-	diff := &BackupDiff{
-		Database:      meta1.Database,
-		Backup1Time:   meta1.Timestamp,
-		Backup2Time:   meta2.Timestamp,
-		TimeDelta:     meta2.Timestamp.Sub(meta1.Timestamp),
-		SizeDelta:     meta2.SizeBytes - meta1.SizeBytes,
-		DurationDelta: meta2.Duration - meta1.Duration,
-	}
-
-	if meta1.SizeBytes > 0 {
-		diff.SizeDeltaPct = (float64(diff.SizeDelta) / float64(meta1.SizeBytes)) * 100.0
-	}
-
-	// If metadata contains table-level info, compare tables
-	// For now, we only have file-level comparison
-	// Future enhancement: parse backup files for table sizes
-
-	return diff
-}
-
-func outputDiffTable(diff *BackupDiff, meta1, meta2 *metadata.BackupMetadata) error {
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════")
-	fmt.Printf("  Backup Comparison: %s\n", diff.Database)
-	fmt.Println("═══════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	// Backup info
-	fmt.Printf("[BACKUP 1]\n")
-	fmt.Printf("  Time:       %s\n", meta1.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Size:       %s (%d bytes)\n", formatBytesForDiff(meta1.SizeBytes), meta1.SizeBytes)
-	fmt.Printf("  Duration:   %.2fs\n", meta1.Duration)
-	fmt.Printf("  Compression: %s\n", meta1.Compression)
-	fmt.Printf("  Type:       %s\n", meta1.BackupType)
-	fmt.Println()
-
-	fmt.Printf("[BACKUP 2]\n")
-	fmt.Printf("  Time:       %s\n", meta2.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Size:       %s (%d bytes)\n", formatBytesForDiff(meta2.SizeBytes), meta2.SizeBytes)
-	fmt.Printf("  Duration:   %.2fs\n", meta2.Duration)
-	fmt.Printf("  Compression: %s\n", meta2.Compression)
-	fmt.Printf("  Type:       %s\n", meta2.BackupType)
-	fmt.Println()
-
-	// Deltas
-	fmt.Println("───────────────────────────────────────────────────────────")
-	fmt.Println("[CHANGES]")
-	fmt.Println("───────────────────────────────────────────────────────────")
-
-	// Time delta
-	timeDelta := diff.TimeDelta
-	fmt.Printf("  Time Between:   %s\n", formatDurationForDiff(timeDelta))
-
-	// Size delta
-	sizeIcon := "="
-	if diff.SizeDelta > 0 {
-		sizeIcon = "↑"
-		fmt.Printf("  Size Change:    %s %s (+%.1f%%)\n",
-			sizeIcon, formatBytesForDiff(diff.SizeDelta), diff.SizeDeltaPct)
-	} else if diff.SizeDelta < 0 {
-		sizeIcon = "↓"
-		fmt.Printf("  Size Change:    %s %s (%.1f%%)\n",
-			sizeIcon, formatBytesForDiff(-diff.SizeDelta), diff.SizeDeltaPct)
-	} else {
-		fmt.Printf("  Size Change:    %s No change\n", sizeIcon)
-	}
-
-	// Duration delta
-	durDelta := diff.DurationDelta
-	durIcon := "="
-	if durDelta > 0 {
-		durIcon = "↑"
-		durPct := (durDelta / meta1.Duration) * 100.0
-		fmt.Printf("  Duration:       %s +%.2fs (+%.1f%%)\n", durIcon, durDelta, durPct)
-	} else if durDelta < 0 {
-		durIcon = "↓"
-		durPct := (-durDelta / meta1.Duration) * 100.0
-		fmt.Printf("  Duration:       %s -%.2fs (-%.1f%%)\n", durIcon, -durDelta, durPct)
-	} else {
-		fmt.Printf("  Duration:       %s No change\n", durIcon)
-	}
-
-	// Compression efficiency
-	if meta1.Compression != "none" && meta2.Compression != "none" {
-		fmt.Println()
-		fmt.Println("[COMPRESSION ANALYSIS]")
-		// Note: We'd need uncompressed sizes to calculate actual compression ratio
-		fmt.Printf("  Backup 1:       %s\n", meta1.Compression)
-		fmt.Printf("  Backup 2:       %s\n", meta2.Compression)
-		if meta1.Compression != meta2.Compression {
-			fmt.Printf("  ⚠ Compression method changed\n")
-		}
-	}
-
-	// Database growth rate
-	if diff.TimeDelta.Hours() > 0 {
-		growthPerDay := float64(diff.SizeDelta) / diff.TimeDelta.Hours() * 24.0
-		fmt.Println()
-		fmt.Println("[GROWTH RATE]")
-		if growthPerDay > 0 {
-			fmt.Printf("  Database growing at ~%s/day\n", formatBytesForDiff(int64(growthPerDay)))
-
-			// Project forward
-			daysTo10GB := (10*1024*1024*1024 - float64(meta2.SizeBytes)) / growthPerDay
-			if daysTo10GB > 0 && daysTo10GB < 365 {
-				fmt.Printf("  Will reach 10GB in ~%.0f days\n", daysTo10GB)
-			}
-		} else if growthPerDay < 0 {
-			fmt.Printf("  Database shrinking at ~%s/day\n", formatBytesForDiff(int64(-growthPerDay)))
-		} else {
-			fmt.Printf("  Database size stable\n")
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════")
-
-	if diffVerbose {
-		fmt.Println()
-		fmt.Println("[METADATA DIFF]")
-		fmt.Printf("  Host:         %s → %s\n", meta1.Host, meta2.Host)
-		fmt.Printf("  Port:         %d → %d\n", meta1.Port, meta2.Port)
-		fmt.Printf("  DB Version:   %s → %s\n", meta1.DatabaseVersion, meta2.DatabaseVersion)
-		fmt.Printf("  Encrypted:    %v → %v\n", meta1.Encrypted, meta2.Encrypted)
-		fmt.Printf("  Checksum 1:   %s\n", meta1.SHA256[:16]+"...")
-		fmt.Printf("  Checksum 2:   %s\n", meta2.SHA256[:16]+"...")
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func outputDiffJSON(diff *BackupDiff, meta1, meta2 *metadata.BackupMetadata) error {
-	output := map[string]interface{}{
-		"database": diff.Database,
-		"backup1": map[string]interface{}{
-			"timestamp":   meta1.Timestamp,
-			"size_bytes":  meta1.SizeBytes,
-			"duration":    meta1.Duration,
-			"compression": meta1.Compression,
-			"type":        meta1.BackupType,
-			"version":     meta1.DatabaseVersion,
-		},
-		"backup2": map[string]interface{}{
-			"timestamp":   meta2.Timestamp,
-			"size_bytes":  meta2.SizeBytes,
-			"duration":    meta2.Duration,
-			"compression": meta2.Compression,
-			"type":        meta2.BackupType,
-			"version":     meta2.DatabaseVersion,
-		},
-		"diff": map[string]interface{}{
-			"time_delta_hours": diff.TimeDelta.Hours(),
-			"size_delta_bytes": diff.SizeDelta,
-			"size_delta_pct":   diff.SizeDeltaPct,
-			"duration_delta":   diff.DurationDelta,
-		},
-	}
-
-	// Calculate growth rate
-	if diff.TimeDelta.Hours() > 0 {
-		growthPerDay := float64(diff.SizeDelta) / diff.TimeDelta.Hours() * 24.0
-		output["growth_rate_bytes_per_day"] = growthPerDay
-	}
-
-	data, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Println(string(data))
-	return nil
-}
-
-// Utility wrappers
-func formatBytesForDiff(bytes int64) string {
-	if bytes < 0 {
-		return "-" + formatBytesForDiff(-bytes)
-	}
-
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-
-	return fmt.Sprintf("%.2f %ciB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}
-
-func formatDurationForDiff(d time.Duration) string {
-	if d < 0 {
-		return "-" + formatDurationForDiff(-d)
-	}
-
-	days := int(d.Hours() / 24)
-	hours := int(d.Hours()) % 24
-	minutes := int(d.Minutes()) % 60
-
-	if days > 0 {
-		return fmt.Sprintf("%dd %dh %dm", days, hours, minutes)
-	}
-	if hours > 0 {
-		return fmt.Sprintf("%dh %dm", hours, minutes)
-	}
-	return fmt.Sprintf("%dm", minutes)
-}

cmd/backup_impl.go

@@ -12,9 +12,7 @@ import (
 	"dbbackup/internal/checks"
 	"dbbackup/internal/config"
 	"dbbackup/internal/database"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/security"
-	"dbbackup/internal/validation"
 )
 
 // runClusterBackup performs a full cluster backup
@@ -31,11 +29,6 @@ func runClusterBackup(ctx context.Context) error {
 		return fmt.Errorf("configuration error: %w", err)
 	}
 
-	// Validate input parameters with comprehensive security checks
-	if err := validateBackupParams(cfg); err != nil {
-		return fmt.Errorf("validation error: %w", err)
-	}
-
 	// Handle dry-run mode
 	if backupDryRun {
 		return runBackupPreflight(ctx, "")
@@ -64,17 +57,6 @@ func runClusterBackup(ctx context.Context) error {
 	user := security.GetCurrentUser()
 	auditLogger.LogBackupStart(user, "all_databases", "cluster")
 
-	// Track start time for notifications
-	backupStartTime := time.Now()
-
-	// Notify: backup started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupStarted, notify.SeverityInfo, "Cluster backup started").
-			WithDatabase("all_databases").
-			WithDetail("host", cfg.Host).
-			WithDetail("backup_dir", cfg.BackupDir))
-	}
-
 	// Rate limit connection attempts
 	host := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
 	if err := rateLimiter.CheckAndWait(host); err != nil {
@@ -104,13 +86,6 @@ func runClusterBackup(ctx context.Context) error {
 	// Perform cluster backup
 	if err := engine.BackupCluster(ctx); err != nil {
 		auditLogger.LogBackupFailed(user, "all_databases", err)
-		// Notify: backup failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Cluster backup failed").
-				WithDatabase("all_databases").
-				WithError(err).
-				WithDuration(time.Since(backupStartTime)))
-		}
 		return err
 	}
 
@@ -118,13 +93,6 @@ func runClusterBackup(ctx context.Context) error {
 	if isEncryptionEnabled() {
 		if err := encryptLatestClusterBackup(); err != nil {
 			log.Error("Failed to encrypt backup", "error", err)
-			// Notify: encryption failed
-			if notifyManager != nil {
-				notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Backup encryption failed").
-					WithDatabase("all_databases").
-					WithError(err).
-					WithDuration(time.Since(backupStartTime)))
-			}
 			return fmt.Errorf("backup completed successfully but encryption failed. Unencrypted backup remains in %s: %w", cfg.BackupDir, err)
 		}
 		log.Info("Cluster backup encrypted successfully")
@@ -133,14 +101,6 @@ func runClusterBackup(ctx context.Context) error {
 	// Audit log: backup success
 	auditLogger.LogBackupComplete(user, "all_databases", cfg.BackupDir, 0)
 
-	// Notify: backup completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupCompleted, notify.SeveritySuccess, "Cluster backup completed successfully").
-			WithDatabase("all_databases").
-			WithDuration(time.Since(backupStartTime)).
-			WithDetail("backup_dir", cfg.BackupDir))
-	}
-
 	// Cleanup old backups if retention policy is enabled
 	if cfg.RetentionDays > 0 {
 		retentionPolicy := security.NewRetentionPolicy(cfg.RetentionDays, cfg.MinBackups, log)
@@ -170,28 +130,20 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	// Update config from environment
 	cfg.UpdateFromEnvironment()
 
-	// IMPORTANT: Set the database name from positional argument
-	// This overrides the default 'postgres' when using MySQL
-	cfg.Database = databaseName
-
 	// Validate configuration
 	if err := cfg.Validate(); err != nil {
 		return fmt.Errorf("configuration error: %w", err)
 	}
 
-	// Validate input parameters with comprehensive security checks
-	if err := validateBackupParams(cfg); err != nil {
-		return fmt.Errorf("validation error: %w", err)
-	}
-
 	// Handle dry-run mode
 	if backupDryRun {
 		return runBackupPreflight(ctx, databaseName)
 	}
 
-	// Get backup type and base backup from command line flags
-	backupType := backupTypeFlag
-	baseBackup := baseBackupFlag
+	// Get backup type and base backup from command line flags (set via global vars in PreRunE)
+	// These are populated by cobra flag binding in cmd/backup.go
+	backupType := "full" // Default to full backup if not specified
+	baseBackup := ""     // Base backup path for incremental backups
 
 	// Validate backup type
 	if backupType != "full" && backupType != "incremental" {
@@ -234,17 +186,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	user := security.GetCurrentUser()
 	auditLogger.LogBackupStart(user, databaseName, "single")
 
-	// Track start time for notifications
-	backupStartTime := time.Now()
-
-	// Notify: backup started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupStarted, notify.SeverityInfo, "Database backup started").
-			WithDatabase(databaseName).
-			WithDetail("host", cfg.Host).
-			WithDetail("backup_type", backupType))
-	}
-
 	// Rate limit connection attempts
 	host := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
 	if err := rateLimiter.CheckAndWait(host); err != nil {
@@ -280,27 +221,7 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 		return err
 	}
 
-	// Check if native engine should be used
-	if cfg.UseNativeEngine {
-		log.Info("Using native engine for backup", "database", databaseName)
-		err = runNativeBackup(ctx, db, databaseName, backupType, baseBackup, backupStartTime, user)
-
-		if err != nil && cfg.FallbackToTools {
-			// Check if this is an expected authentication failure (peer auth doesn't provide password to native engine)
-			errStr := err.Error()
-			if strings.Contains(errStr, "password authentication failed") || strings.Contains(errStr, "SASL auth") {
-				log.Info("Native engine requires password auth, using pg_dump with peer authentication")
-			} else {
-				log.Warn("Native engine failed, falling back to external tools", "error", err)
-			}
-			// Continue with tool-based backup below
-		} else {
-			// Native engine succeeded or no fallback configured
-			return err // Return success (nil) or failure
-		}
-	}
-
-	// Create backup engine (tool-based)
+	// Create backup engine
 	engine := backup.New(cfg, log, db)
 
 	// Perform backup based on type
@@ -347,13 +268,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 
 	if backupErr != nil {
 		auditLogger.LogBackupFailed(user, databaseName, backupErr)
-		// Notify: backup failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Database backup failed").
-				WithDatabase(databaseName).
-				WithError(backupErr).
-				WithDuration(time.Since(backupStartTime)))
-		}
 		return backupErr
 	}
 
@@ -361,13 +275,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	if isEncryptionEnabled() {
 		if err := encryptLatestBackup(databaseName); err != nil {
 			log.Error("Failed to encrypt backup", "error", err)
-			// Notify: encryption failed
-			if notifyManager != nil {
-				notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Backup encryption failed").
-					WithDatabase(databaseName).
-					WithError(err).
-					WithDuration(time.Since(backupStartTime)))
-			}
 			return fmt.Errorf("backup succeeded but encryption failed: %w", err)
 		}
 		log.Info("Backup encrypted successfully")
@@ -376,15 +283,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	// Audit log: backup success
 	auditLogger.LogBackupComplete(user, databaseName, cfg.BackupDir, 0)
 
-	// Notify: backup completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupCompleted, notify.SeveritySuccess, "Database backup completed successfully").
-			WithDatabase(databaseName).
-			WithDuration(time.Since(backupStartTime)).
-			WithDetail("backup_dir", cfg.BackupDir).
-			WithDetail("backup_type", backupType))
-	}
-
 	// Cleanup old backups if retention policy is enabled
 	if cfg.RetentionDays > 0 {
 		retentionPolicy := security.NewRetentionPolicy(cfg.RetentionDays, cfg.MinBackups, log)
@@ -414,19 +312,11 @@ func runSampleBackup(ctx context.Context, databaseName string) error {
 	// Update config from environment
 	cfg.UpdateFromEnvironment()
 
-	// IMPORTANT: Set the database name from positional argument
-	cfg.Database = databaseName
-
 	// Validate configuration
 	if err := cfg.Validate(); err != nil {
 		return fmt.Errorf("configuration error: %w", err)
 	}
 
-	// Validate input parameters with comprehensive security checks
-	if err := validateBackupParams(cfg); err != nil {
-		return fmt.Errorf("validation error: %w", err)
-	}
-
 	// Handle dry-run mode
 	if backupDryRun {
 		return runBackupPreflight(ctx, databaseName)
@@ -684,61 +574,3 @@ func runBackupPreflight(ctx context.Context, databaseName string) error {
 
 	return nil
 }
-
-// validateBackupParams performs comprehensive input validation for backup parameters
-func validateBackupParams(cfg *config.Config) error {
-	var errs []string
-
-	// Validate backup directory
-	if cfg.BackupDir != "" {
-		if err := validation.ValidateBackupDir(cfg.BackupDir); err != nil {
-			errs = append(errs, fmt.Sprintf("backup directory: %s", err))
-		}
-	}
-
-	// Validate job count
-	if cfg.Jobs > 0 {
-		if err := validation.ValidateJobs(cfg.Jobs); err != nil {
-			errs = append(errs, fmt.Sprintf("jobs: %s", err))
-		}
-	}
-
-	// Validate database name
-	if cfg.Database != "" {
-		if err := validation.ValidateDatabaseName(cfg.Database, cfg.DatabaseType); err != nil {
-			errs = append(errs, fmt.Sprintf("database name: %s", err))
-		}
-	}
-
-	// Validate host
-	if cfg.Host != "" {
-		if err := validation.ValidateHost(cfg.Host); err != nil {
-			errs = append(errs, fmt.Sprintf("host: %s", err))
-		}
-	}
-
-	// Validate port
-	if cfg.Port > 0 {
-		if err := validation.ValidatePort(cfg.Port); err != nil {
-			errs = append(errs, fmt.Sprintf("port: %s", err))
-		}
-	}
-
-	// Validate retention days
-	if cfg.RetentionDays > 0 {
-		if err := validation.ValidateRetentionDays(cfg.RetentionDays); err != nil {
-			errs = append(errs, fmt.Sprintf("retention days: %s", err))
-		}
-	}
-
-	// Validate compression level
-	if err := validation.ValidateCompressionLevel(cfg.CompressionLevel); err != nil {
-		errs = append(errs, fmt.Sprintf("compression level: %s", err))
-	}
-
-	if len(errs) > 0 {
-		return fmt.Errorf("validation failed: %s", strings.Join(errs, "; "))
-	}
-
-	return nil
-}

cmd/blob.go

@@ -1,318 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"os"
-	"strings"
-	"text/tabwriter"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	_ "github.com/go-sql-driver/mysql"
-	_ "github.com/jackc/pgx/v5/stdlib" // PostgreSQL driver
-)
-
-var blobCmd = &cobra.Command{
-	Use:   "blob",
-	Short: "Large object (BLOB/BYTEA) operations",
-	Long: `Analyze and manage large binary objects stored in databases.
-
-Many applications store large binary data (images, PDFs, attachments) directly
-in the database. This can cause:
-- Slow backups and restores
-- Poor deduplication ratios
-- Excessive storage usage
-
-The blob commands help you identify and manage this data.
-
-Available Commands:
-  stats      Scan database for blob columns and show size statistics
-  extract    Extract blobs to external storage (coming soon)
-  rehydrate  Restore blobs from external storage (coming soon)`,
-}
-
-var blobStatsCmd = &cobra.Command{
-	Use:   "stats",
-	Short: "Show blob column statistics",
-	Long: `Scan the database for BLOB/BYTEA columns and display size statistics.
-
-This helps identify tables storing large binary data that might benefit
-from blob extraction for faster backups.
-
-PostgreSQL column types detected:
-  - bytea
-  - oid (large objects)
-
-MySQL/MariaDB column types detected:
-  - blob, mediumblob, longblob, tinyblob
-  - binary, varbinary
-
-Example:
-  dbbackup blob stats
-  dbbackup blob stats -d myapp_production`,
-	RunE: runBlobStats,
-}
-
-func init() {
-	rootCmd.AddCommand(blobCmd)
-	blobCmd.AddCommand(blobStatsCmd)
-}
-
-func runBlobStats(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	// Connect to database
-	var db *sql.DB
-	var err error
-
-	if cfg.IsPostgreSQL() {
-		// PostgreSQL connection string
-		connStr := fmt.Sprintf("host=%s port=%d user=%s dbname=%s sslmode=disable",
-			cfg.Host, cfg.Port, cfg.User, cfg.Database)
-		if cfg.Password != "" {
-			connStr += fmt.Sprintf(" password=%s", cfg.Password)
-		}
-		db, err = sql.Open("pgx", connStr)
-	} else {
-		// MySQL DSN
-		connStr := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s",
-			cfg.User, cfg.Password, cfg.Host, cfg.Port, cfg.Database)
-		db, err = sql.Open("mysql", connStr)
-	}
-	if err != nil {
-		return fmt.Errorf("failed to connect: %w", err)
-	}
-	defer db.Close()
-
-	fmt.Printf("Scanning %s for blob columns...\n\n", cfg.DisplayDatabaseType())
-
-	// Discover blob columns
-	type BlobColumn struct {
-		Schema    string
-		Table     string
-		Column    string
-		DataType  string
-		RowCount  int64
-		TotalSize int64
-		AvgSize   int64
-		MaxSize   int64
-		NullCount int64
-	}
-
-	var columns []BlobColumn
-
-	if cfg.IsPostgreSQL() {
-		query := `
-			SELECT 
-				table_schema,
-				table_name,
-				column_name,
-				data_type
-			FROM information_schema.columns
-			WHERE data_type IN ('bytea', 'oid')
-			  AND table_schema NOT IN ('pg_catalog', 'information_schema')
-			ORDER BY table_schema, table_name, column_name
-		`
-		rows, err := db.QueryContext(ctx, query)
-		if err != nil {
-			return fmt.Errorf("failed to query columns: %w", err)
-		}
-		defer rows.Close()
-
-		for rows.Next() {
-			var col BlobColumn
-			if err := rows.Scan(&col.Schema, &col.Table, &col.Column, &col.DataType); err != nil {
-				continue
-			}
-			columns = append(columns, col)
-		}
-	} else {
-		query := `
-			SELECT 
-				TABLE_SCHEMA,
-				TABLE_NAME,
-				COLUMN_NAME,
-				DATA_TYPE
-			FROM information_schema.COLUMNS
-			WHERE DATA_TYPE IN ('blob', 'mediumblob', 'longblob', 'tinyblob', 'binary', 'varbinary')
-			  AND TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys')
-			ORDER BY TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME
-		`
-		rows, err := db.QueryContext(ctx, query)
-		if err != nil {
-			return fmt.Errorf("failed to query columns: %w", err)
-		}
-		defer rows.Close()
-
-		for rows.Next() {
-			var col BlobColumn
-			if err := rows.Scan(&col.Schema, &col.Table, &col.Column, &col.DataType); err != nil {
-				continue
-			}
-			columns = append(columns, col)
-		}
-	}
-
-	if len(columns) == 0 {
-		fmt.Println("✓ No blob columns found in this database")
-		return nil
-	}
-
-	fmt.Printf("Found %d blob column(s), scanning sizes...\n\n", len(columns))
-
-	// Scan each column for size stats
-	var totalBlobs, totalSize int64
-	for i := range columns {
-		col := &columns[i]
-
-		var query string
-		var fullName, colName string
-
-		if cfg.IsPostgreSQL() {
-			fullName = fmt.Sprintf(`"%s"."%s"`, col.Schema, col.Table)
-			colName = fmt.Sprintf(`"%s"`, col.Column)
-			query = fmt.Sprintf(`
-				SELECT 
-					COUNT(*),
-					COALESCE(SUM(COALESCE(octet_length(%s), 0)), 0),
-					COALESCE(AVG(COALESCE(octet_length(%s), 0)), 0),
-					COALESCE(MAX(COALESCE(octet_length(%s), 0)), 0),
-					COUNT(*) - COUNT(%s)
-				FROM %s
-			`, colName, colName, colName, colName, fullName)
-		} else {
-			fullName = fmt.Sprintf("`%s`.`%s`", col.Schema, col.Table)
-			colName = fmt.Sprintf("`%s`", col.Column)
-			query = fmt.Sprintf(`
-				SELECT 
-					COUNT(*),
-					COALESCE(SUM(COALESCE(LENGTH(%s), 0)), 0),
-					COALESCE(AVG(COALESCE(LENGTH(%s), 0)), 0),
-					COALESCE(MAX(COALESCE(LENGTH(%s), 0)), 0),
-					COUNT(*) - COUNT(%s)
-				FROM %s
-			`, colName, colName, colName, colName, fullName)
-		}
-
-		scanCtx, scanCancel := context.WithTimeout(ctx, 30*time.Second)
-		row := db.QueryRowContext(scanCtx, query)
-		var avgSize float64
-		err := row.Scan(&col.RowCount, &col.TotalSize, &avgSize, &col.MaxSize, &col.NullCount)
-		col.AvgSize = int64(avgSize)
-		scanCancel()
-
-		if err != nil {
-			log.Warn("Failed to scan column", "table", fullName, "column", col.Column, "error", err)
-			continue
-		}
-
-		totalBlobs += col.RowCount - col.NullCount
-		totalSize += col.TotalSize
-	}
-
-	// Print summary
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n")
-	fmt.Printf("BLOB STATISTICS SUMMARY\n")
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n")
-	fmt.Printf("Total blob columns:  %d\n", len(columns))
-	fmt.Printf("Total blob values:   %s\n", formatNumberWithCommas(totalBlobs))
-	fmt.Printf("Total blob size:     %s\n", formatBytesHuman(totalSize))
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n\n")
-
-	// Print detailed table
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "SCHEMA\tTABLE\tCOLUMN\tTYPE\tROWS\tNON-NULL\tTOTAL SIZE\tAVG SIZE\tMAX SIZE\n")
-	fmt.Fprintf(w, "──────\t─────\t──────\t────\t────\t────────\t──────────\t────────\t────────\n")
-
-	for _, col := range columns {
-		nonNull := col.RowCount - col.NullCount
-		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
-			truncateBlobStr(col.Schema, 15),
-			truncateBlobStr(col.Table, 20),
-			truncateBlobStr(col.Column, 15),
-			col.DataType,
-			formatNumberWithCommas(col.RowCount),
-			formatNumberWithCommas(nonNull),
-			formatBytesHuman(col.TotalSize),
-			formatBytesHuman(col.AvgSize),
-			formatBytesHuman(col.MaxSize),
-		)
-	}
-	w.Flush()
-
-	// Show top tables by size
-	if len(columns) > 1 {
-		fmt.Println("\n───────────────────────────────────────────────────────────────────")
-		fmt.Println("TOP TABLES BY BLOB SIZE:")
-
-		// Simple sort (bubble sort is fine for small lists)
-		for i := 0; i < len(columns)-1; i++ {
-			for j := i + 1; j < len(columns); j++ {
-				if columns[j].TotalSize > columns[i].TotalSize {
-					columns[i], columns[j] = columns[j], columns[i]
-				}
-			}
-		}
-
-		for i, col := range columns {
-			if i >= 5 || col.TotalSize == 0 {
-				break
-			}
-			pct := float64(col.TotalSize) / float64(totalSize) * 100
-			fmt.Printf("  %d. %s.%s.%s: %s (%.1f%%)\n",
-				i+1, col.Schema, col.Table, col.Column,
-				formatBytesHuman(col.TotalSize), pct)
-		}
-	}
-
-	// Recommendations
-	if totalSize > 100*1024*1024 { // > 100MB
-		fmt.Println("\n───────────────────────────────────────────────────────────────────")
-		fmt.Println("RECOMMENDATIONS:")
-		fmt.Printf("  • You have %s of blob data which could benefit from extraction\n", formatBytesHuman(totalSize))
-		fmt.Println("  • Consider using 'dbbackup blob extract' to externalize large objects")
-		fmt.Println("  • This can improve backup speed and deduplication ratios")
-	}
-
-	return nil
-}
-
-func formatBytesHuman(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}
-
-func formatNumberWithCommas(n int64) string {
-	str := fmt.Sprintf("%d", n)
-	if len(str) <= 3 {
-		return str
-	}
-
-	var result strings.Builder
-	for i, c := range str {
-		if i > 0 && (len(str)-i)%3 == 0 {
-			result.WriteRune(',')
-		}
-		result.WriteRune(c)
-	}
-	return result.String()
-}
-
-func truncateBlobStr(s string, max int) string {
-	if len(s) <= max {
-		return s
-	}
-	return s[:max-1] + "…"
-}

cmd/catalog.go

@@ -178,35 +178,6 @@ Examples:
 	RunE: runCatalogInfo,
 }
 
-var catalogPruneCmd = &cobra.Command{
-	Use:   "prune",
-	Short: "Remove old or invalid entries from catalog",
-	Long: `Clean up the catalog by removing entries that meet specified criteria.
-
-This command can remove:
-  - Entries for backups that no longer exist on disk
-  - Entries older than a specified retention period
-  - Failed or corrupted backups
-  - Entries marked as deleted
-
-Examples:
-  # Remove entries for missing backup files
-  dbbackup catalog prune --missing
-
-  # Remove entries older than 90 days
-  dbbackup catalog prune --older-than 90d
-
-  # Remove failed backups
-  dbbackup catalog prune --status failed
-
-  # Dry run (preview without deleting)
-  dbbackup catalog prune --missing --dry-run
-
-  # Combined: remove missing and old entries
-  dbbackup catalog prune --missing --older-than 30d`,
-	RunE: runCatalogPrune,
-}
-
 func init() {
 	rootCmd.AddCommand(catalogCmd)
 
@@ -226,7 +197,6 @@ func init() {
 	catalogCmd.AddCommand(catalogGapsCmd)
 	catalogCmd.AddCommand(catalogSearchCmd)
 	catalogCmd.AddCommand(catalogInfoCmd)
-	catalogCmd.AddCommand(catalogPruneCmd)
 
 	// Sync flags
 	catalogSyncCmd.Flags().BoolVarP(&catalogVerbose, "verbose", "v", false, "Show detailed output")
@@ -251,13 +221,6 @@ func init() {
 	catalogSearchCmd.Flags().Bool("verified", false, "Only verified backups")
 	catalogSearchCmd.Flags().Bool("encrypted", false, "Only encrypted backups")
 	catalogSearchCmd.Flags().Bool("drill-tested", false, "Only drill-tested backups")
-
-	// Prune flags
-	catalogPruneCmd.Flags().Bool("missing", false, "Remove entries for missing backup files")
-	catalogPruneCmd.Flags().String("older-than", "", "Remove entries older than duration (e.g., 90d, 6m, 1y)")
-	catalogPruneCmd.Flags().String("status", "", "Remove entries with specific status (failed, corrupted, deleted)")
-	catalogPruneCmd.Flags().Bool("dry-run", false, "Preview changes without actually deleting")
-	catalogPruneCmd.Flags().StringVar(&catalogDatabase, "database", "", "Only prune entries for specific database")
 }
 
 func getDefaultConfigDir() string {
@@ -308,20 +271,12 @@ func runCatalogSync(cmd *cobra.Command, args []string) error {
 	fmt.Printf("  [OK] Added:   %d\n", result.Added)
 	fmt.Printf("  [SYNC] Updated: %d\n", result.Updated)
 	fmt.Printf("  [DEL]  Removed: %d\n", result.Removed)
-	if result.Skipped > 0 {
-		fmt.Printf("  [SKIP] Skipped: %d (legacy files without metadata)\n", result.Skipped)
-	}
 	if result.Errors > 0 {
 		fmt.Printf("  [FAIL] Errors:  %d\n", result.Errors)
 	}
 	fmt.Printf("  [TIME]  Duration: %.2fs\n", result.Duration)
 	fmt.Printf("=====================================================\n")
 
-	// Show legacy backup warning
-	if result.LegacyWarning != "" {
-		fmt.Printf("\n[WARN] %s\n", result.LegacyWarning)
-	}
-
 	// Show details if verbose
 	if catalogVerbose && len(result.Details) > 0 {
 		fmt.Printf("\nDetails:\n")
@@ -762,146 +717,6 @@ func runCatalogInfo(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func runCatalogPrune(cmd *cobra.Command, args []string) error {
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Parse flags
-	missing, _ := cmd.Flags().GetBool("missing")
-	olderThan, _ := cmd.Flags().GetString("older-than")
-	status, _ := cmd.Flags().GetString("status")
-	dryRun, _ := cmd.Flags().GetBool("dry-run")
-
-	// Validate that at least one criterion is specified
-	if !missing && olderThan == "" && status == "" {
-		return fmt.Errorf("at least one prune criterion must be specified (--missing, --older-than, or --status)")
-	}
-
-	// Parse olderThan duration
-	var cutoffTime *time.Time
-	if olderThan != "" {
-		duration, err := parseDuration(olderThan)
-		if err != nil {
-			return fmt.Errorf("invalid duration: %w", err)
-		}
-		t := time.Now().Add(-duration)
-		cutoffTime = &t
-	}
-
-	// Validate status
-	if status != "" && status != "failed" && status != "corrupted" && status != "deleted" {
-		return fmt.Errorf("invalid status: %s (must be: failed, corrupted, or deleted)", status)
-	}
-
-	pruneConfig := &catalog.PruneConfig{
-		CheckMissing: missing,
-		OlderThan:    cutoffTime,
-		Status:       status,
-		Database:     catalogDatabase,
-		DryRun:       dryRun,
-	}
-
-	fmt.Printf("=====================================================\n")
-	if dryRun {
-		fmt.Printf("  Catalog Prune (DRY RUN)\n")
-	} else {
-		fmt.Printf("  Catalog Prune\n")
-	}
-	fmt.Printf("=====================================================\n\n")
-
-	if catalogDatabase != "" {
-		fmt.Printf("[DIR] Database filter: %s\n", catalogDatabase)
-	}
-	if missing {
-		fmt.Printf("[CHK] Checking for missing backup files...\n")
-	}
-	if cutoffTime != nil {
-		fmt.Printf("[TIME]  Removing entries older than: %s (%s)\n", cutoffTime.Format("2006-01-02"), olderThan)
-	}
-	if status != "" {
-		fmt.Printf("[LOG] Removing entries with status: %s\n", status)
-	}
-	fmt.Println()
-
-	result, err := cat.PruneAdvanced(ctx, pruneConfig)
-	if err != nil {
-		return err
-	}
-
-	if result.TotalChecked == 0 {
-		fmt.Printf("[INFO] No entries found matching criteria\n")
-		return nil
-	}
-
-	// Show results
-	fmt.Printf("=====================================================\n")
-	fmt.Printf("  Prune Results\n")
-	fmt.Printf("=====================================================\n")
-	fmt.Printf("  [CHK] Checked:  %d entries\n", result.TotalChecked)
-	if dryRun {
-		fmt.Printf("  [WAIT] Would remove: %d entries\n", result.Removed)
-	} else {
-		fmt.Printf("  [DEL]  Removed:  %d entries\n", result.Removed)
-	}
-	fmt.Printf("  [TIME]   Duration: %.2fs\n", result.Duration)
-	fmt.Printf("=====================================================\n")
-
-	if len(result.Details) > 0 {
-		fmt.Printf("\nRemoved entries:\n")
-		for _, detail := range result.Details {
-			fmt.Printf("  • %s\n", detail)
-		}
-	}
-
-	if result.SpaceFreed > 0 {
-		fmt.Printf("\n[SAVE] Estimated space freed: %s\n", catalog.FormatSize(result.SpaceFreed))
-	}
-
-	if dryRun {
-		fmt.Printf("\n[INFO] This was a dry run. Run without --dry-run to actually delete entries.\n")
-	}
-
-	return nil
-}
-
-// parseDuration extends time.ParseDuration to support days, months, years
-func parseDuration(s string) (time.Duration, error) {
-	if len(s) < 2 {
-		return 0, fmt.Errorf("invalid duration: %s", s)
-	}
-
-	unit := s[len(s)-1]
-	value := s[:len(s)-1]
-
-	var multiplier time.Duration
-	switch unit {
-	case 'd': // days
-		multiplier = 24 * time.Hour
-	case 'w': // weeks
-		multiplier = 7 * 24 * time.Hour
-	case 'm': // months (approximate)
-		multiplier = 30 * 24 * time.Hour
-	case 'y': // years (approximate)
-		multiplier = 365 * 24 * time.Hour
-	default:
-		// Try standard time.ParseDuration
-		return time.ParseDuration(s)
-	}
-
-	var num int
-	_, err := fmt.Sscanf(value, "%d", &num)
-	if err != nil {
-		return 0, fmt.Errorf("invalid duration value: %s", value)
-	}
-
-	return time.Duration(num) * multiplier, nil
-}
-
 func truncateString(s string, maxLen int) string {
 	if len(s) <= maxLen {
 		return s

cmd/catalog_dashboard.go

@@ -1,68 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"dbbackup/internal/tui"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/spf13/cobra"
-)
-
-var catalogDashboardCmd = &cobra.Command{
-	Use:   "dashboard",
-	Short: "Interactive catalog browser (TUI)",
-	Long: `Launch an interactive terminal UI for browsing and managing backup catalog.
-
-The catalog dashboard provides:
-  - Browse all backups in an interactive table
-  - Sort by date, size, database, or type
-  - Filter backups by database or search term
-  - View detailed backup information
-  - Pagination for large catalogs
-  - Real-time statistics
-
-Navigation:
-  ↑/↓ or k/j    - Navigate entries
-  ←/→ or h/l    - Previous/next page
-  Enter         - View backup details
-  s             - Cycle sort (date → size → database → type)
-  r             - Reverse sort order
-  d             - Filter by database (cycle through)
-  /             - Search/filter
-  c             - Clear filters
-  R             - Reload catalog
-  q or ESC      - Quit (or return from details)
-
-Examples:
-  # Launch catalog dashboard
-  dbbackup catalog dashboard
-
-  # Dashboard shows:
-  # - Total backups and size
-  # - Sortable table with all backups
-  # - Pagination controls
-  # - Interactive filtering`,
-	RunE: runCatalogDashboard,
-}
-
-func init() {
-	catalogCmd.AddCommand(catalogDashboardCmd)
-}
-
-func runCatalogDashboard(cmd *cobra.Command, args []string) error {
-	// Check if we're in a terminal
-	if !tui.IsInteractiveTerminal() {
-		return fmt.Errorf("catalog dashboard requires an interactive terminal")
-	}
-
-	// Create and run the TUI
-	model := tui.NewCatalogDashboardView()
-	p := tea.NewProgram(model, tea.WithAltScreen())
-
-	if _, err := p.Run(); err != nil {
-		return fmt.Errorf("failed to run catalog dashboard: %w", err)
-	}
-
-	return nil
-}

cmd/catalog_export.go

@@ -1,455 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/csv"
-	"encoding/json"
-	"fmt"
-	"html"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"dbbackup/internal/catalog"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	exportOutput string
-	exportFormat string
-)
-
-// catalogExportCmd exports catalog to various formats
-var catalogExportCmd = &cobra.Command{
-	Use:   "export",
-	Short: "Export catalog to file (CSV/HTML/JSON)",
-	Long: `Export backup catalog to various formats for analysis, reporting, or archival.
-
-Supports:
-  - CSV format for spreadsheet import (Excel, LibreOffice)
-  - HTML format for web-based reports and documentation
-  - JSON format for programmatic access and integration
-
-Examples:
-  # Export to CSV
-  dbbackup catalog export --format csv --output backups.csv
-
-  # Export to HTML report
-  dbbackup catalog export --format html --output report.html
-
-  # Export specific database
-  dbbackup catalog export --format csv --database myapp --output myapp_backups.csv
-
-  # Export date range
-  dbbackup catalog export --format html --after 2026-01-01 --output january_report.html`,
-	RunE: runCatalogExport,
-}
-
-func init() {
-	catalogCmd.AddCommand(catalogExportCmd)
-	catalogExportCmd.Flags().StringVarP(&exportOutput, "output", "o", "", "Output file path (required)")
-	catalogExportCmd.Flags().StringVarP(&exportFormat, "format", "f", "csv", "Export format: csv, html, json")
-	catalogExportCmd.Flags().StringVar(&catalogDatabase, "database", "", "Filter by database name")
-	catalogExportCmd.Flags().StringVar(&catalogStartDate, "after", "", "Show backups after date (YYYY-MM-DD)")
-	catalogExportCmd.Flags().StringVar(&catalogEndDate, "before", "", "Show backups before date (YYYY-MM-DD)")
-	catalogExportCmd.MarkFlagRequired("output")
-}
-
-func runCatalogExport(cmd *cobra.Command, args []string) error {
-	if exportOutput == "" {
-		return fmt.Errorf("--output flag required")
-	}
-
-	// Validate format
-	exportFormat = strings.ToLower(exportFormat)
-	if exportFormat != "csv" && exportFormat != "html" && exportFormat != "json" {
-		return fmt.Errorf("invalid format: %s (supported: csv, html, json)", exportFormat)
-	}
-
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Build query
-	query := &catalog.SearchQuery{
-		Database:  catalogDatabase,
-		Limit:     0, // No limit - export all
-		OrderBy:   "created_at",
-		OrderDesc: false, // Chronological order for exports
-	}
-
-	// Parse dates if provided
-	if catalogStartDate != "" {
-		after, err := time.Parse("2006-01-02", catalogStartDate)
-		if err != nil {
-			return fmt.Errorf("invalid --after date format (use YYYY-MM-DD): %w", err)
-		}
-		query.StartDate = &after
-	}
-
-	if catalogEndDate != "" {
-		before, err := time.Parse("2006-01-02", catalogEndDate)
-		if err != nil {
-			return fmt.Errorf("invalid --before date format (use YYYY-MM-DD): %w", err)
-		}
-		query.EndDate = &before
-	}
-
-	// Search backups
-	entries, err := cat.Search(ctx, query)
-	if err != nil {
-		return fmt.Errorf("failed to search catalog: %w", err)
-	}
-
-	if len(entries) == 0 {
-		fmt.Println("No backups found matching criteria")
-		return nil
-	}
-
-	// Export based on format
-	switch exportFormat {
-	case "csv":
-		return exportCSV(entries, exportOutput)
-	case "html":
-		return exportHTML(entries, exportOutput, catalogDatabase)
-	case "json":
-		return exportJSON(entries, exportOutput)
-	default:
-		return fmt.Errorf("unsupported format: %s", exportFormat)
-	}
-}
-
-// exportCSV exports entries to CSV format
-func exportCSV(entries []*catalog.Entry, outputPath string) error {
-	file, err := os.Create(outputPath)
-	if err != nil {
-		return fmt.Errorf("failed to create output file: %w", err)
-	}
-	defer file.Close()
-
-	writer := csv.NewWriter(file)
-	defer writer.Flush()
-
-	// Header
-	header := []string{
-		"ID",
-		"Database",
-		"DatabaseType",
-		"Host",
-		"Port",
-		"BackupPath",
-		"BackupType",
-		"SizeBytes",
-		"SizeHuman",
-		"SHA256",
-		"Compression",
-		"Encrypted",
-		"CreatedAt",
-		"DurationSeconds",
-		"Status",
-		"VerifiedAt",
-		"VerifyValid",
-		"TestedAt",
-		"TestSuccess",
-		"RetentionPolicy",
-	}
-
-	if err := writer.Write(header); err != nil {
-		return fmt.Errorf("failed to write CSV header: %w", err)
-	}
-
-	// Data rows
-	for _, entry := range entries {
-		row := []string{
-			fmt.Sprintf("%d", entry.ID),
-			entry.Database,
-			entry.DatabaseType,
-			entry.Host,
-			fmt.Sprintf("%d", entry.Port),
-			entry.BackupPath,
-			entry.BackupType,
-			fmt.Sprintf("%d", entry.SizeBytes),
-			catalog.FormatSize(entry.SizeBytes),
-			entry.SHA256,
-			entry.Compression,
-			fmt.Sprintf("%t", entry.Encrypted),
-			entry.CreatedAt.Format(time.RFC3339),
-			fmt.Sprintf("%.2f", entry.Duration),
-			string(entry.Status),
-			formatTime(entry.VerifiedAt),
-			formatBool(entry.VerifyValid),
-			formatTime(entry.DrillTestedAt),
-			formatBool(entry.DrillSuccess),
-			entry.RetentionPolicy,
-		}
-
-		if err := writer.Write(row); err != nil {
-			return fmt.Errorf("failed to write CSV row: %w", err)
-		}
-	}
-
-	fmt.Printf("✅ Exported %d backups to CSV: %s\n", len(entries), outputPath)
-	fmt.Printf("   Open with Excel, LibreOffice, or other spreadsheet software\n")
-	return nil
-}
-
-// exportHTML exports entries to HTML format with styling
-func exportHTML(entries []*catalog.Entry, outputPath string, database string) error {
-	file, err := os.Create(outputPath)
-	if err != nil {
-		return fmt.Errorf("failed to create output file: %w", err)
-	}
-	defer file.Close()
-
-	title := "Backup Catalog Report"
-	if database != "" {
-		title = fmt.Sprintf("Backup Catalog Report: %s", database)
-	}
-
-	// Write HTML header with embedded CSS
-	htmlHeader := fmt.Sprintf(`<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>%s</title>
-    <style>
-        body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 20px; background: #f5f5f5; }
-        .container { max-width: 1400px; margin: 0 auto; background: white; padding: 30px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
-        h1 { color: #2c3e50; border-bottom: 3px solid #3498db; padding-bottom: 10px; }
-        .summary { background: #ecf0f1; padding: 15px; margin: 20px 0; border-radius: 5px; }
-        .summary-item { display: inline-block; margin-right: 30px; }
-        .summary-label { font-weight: bold; color: #7f8c8d; }
-        .summary-value { color: #2c3e50; font-size: 18px; }
-        table { width: 100%%; border-collapse: collapse; margin-top: 20px; }
-        th { background: #34495e; color: white; padding: 12px; text-align: left; font-weight: 600; }
-        td { padding: 10px; border-bottom: 1px solid #ecf0f1; }
-        tr:hover { background: #f8f9fa; }
-        .status-success { color: #27ae60; font-weight: bold; }
-        .status-fail { color: #e74c3c; font-weight: bold; }
-        .badge { padding: 3px 8px; border-radius: 3px; font-size: 12px; font-weight: bold; }
-        .badge-encrypted { background: #3498db; color: white; }
-        .badge-verified { background: #27ae60; color: white; }
-        .badge-tested { background: #9b59b6; color: white; }
-        .footer { margin-top: 30px; text-align: center; color: #95a5a6; font-size: 12px; }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>%s</h1>
-`, title, title)
-
-	file.WriteString(htmlHeader)
-
-	// Summary section
-	totalSize := int64(0)
-	encryptedCount := 0
-	verifiedCount := 0
-	testedCount := 0
-
-	for _, entry := range entries {
-		totalSize += entry.SizeBytes
-		if entry.Encrypted {
-			encryptedCount++
-		}
-		if entry.VerifyValid != nil && *entry.VerifyValid {
-			verifiedCount++
-		}
-		if entry.DrillSuccess != nil && *entry.DrillSuccess {
-			testedCount++
-		}
-	}
-
-	var oldestBackup, newestBackup time.Time
-	if len(entries) > 0 {
-		oldestBackup = entries[0].CreatedAt
-		newestBackup = entries[len(entries)-1].CreatedAt
-	}
-
-	summaryHTML := fmt.Sprintf(`
-        <div class="summary">
-            <div class="summary-item">
-                <div class="summary-label">Total Backups:</div>
-                <div class="summary-value">%d</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">Total Size:</div>
-                <div class="summary-value">%s</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">Encrypted:</div>
-                <div class="summary-value">%d (%.1f%%)</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">Verified:</div>
-                <div class="summary-value">%d (%.1f%%)</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">DR Tested:</div>
-                <div class="summary-value">%d (%.1f%%)</div>
-            </div>
-        </div>
-        <div class="summary">
-            <div class="summary-item">
-                <div class="summary-label">Oldest Backup:</div>
-                <div class="summary-value">%s</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">Newest Backup:</div>
-                <div class="summary-value">%s</div>
-            </div>
-            <div class="summary-item">
-                <div class="summary-label">Time Span:</div>
-                <div class="summary-value">%s</div>
-            </div>
-        </div>
-`,
-		len(entries),
-		catalog.FormatSize(totalSize),
-		encryptedCount, float64(encryptedCount)/float64(len(entries))*100,
-		verifiedCount, float64(verifiedCount)/float64(len(entries))*100,
-		testedCount, float64(testedCount)/float64(len(entries))*100,
-		oldestBackup.Format("2006-01-02 15:04"),
-		newestBackup.Format("2006-01-02 15:04"),
-		formatTimeSpan(newestBackup.Sub(oldestBackup)),
-	)
-
-	file.WriteString(summaryHTML)
-
-	// Table header
-	tableHeader := `
-        <table>
-            <thead>
-                <tr>
-                    <th>Database</th>
-                    <th>Created</th>
-                    <th>Size</th>
-                    <th>Type</th>
-                    <th>Duration</th>
-                    <th>Status</th>
-                    <th>Attributes</th>
-                </tr>
-            </thead>
-            <tbody>
-`
-	file.WriteString(tableHeader)
-
-	// Table rows
-	for _, entry := range entries {
-		badges := []string{}
-		if entry.Encrypted {
-			badges = append(badges, `<span class="badge badge-encrypted">Encrypted</span>`)
-		}
-		if entry.VerifyValid != nil && *entry.VerifyValid {
-			badges = append(badges, `<span class="badge badge-verified">Verified</span>`)
-		}
-		if entry.DrillSuccess != nil && *entry.DrillSuccess {
-			badges = append(badges, `<span class="badge badge-tested">DR Tested</span>`)
-		}
-
-		statusClass := "status-success"
-		statusText := string(entry.Status)
-		if entry.Status == catalog.StatusFailed {
-			statusClass = "status-fail"
-		}
-
-		row := fmt.Sprintf(`
-                <tr>
-                    <td>%s</td>
-                    <td>%s</td>
-                    <td>%s</td>
-                    <td>%s</td>
-                    <td>%.1fs</td>
-                    <td class="%s">%s</td>
-                    <td>%s</td>
-                </tr>`,
-			html.EscapeString(entry.Database),
-			entry.CreatedAt.Format("2006-01-02 15:04:05"),
-			catalog.FormatSize(entry.SizeBytes),
-			html.EscapeString(entry.BackupType),
-			entry.Duration,
-			statusClass,
-			html.EscapeString(statusText),
-			strings.Join(badges, " "),
-		)
-		file.WriteString(row)
-	}
-
-	// Table footer and close HTML
-	htmlFooter := `
-            </tbody>
-        </table>
-        <div class="footer">
-            Generated by dbbackup on ` + time.Now().Format("2006-01-02 15:04:05") + `
-        </div>
-    </div>
-</body>
-</html>
-`
-	file.WriteString(htmlFooter)
-
-	fmt.Printf("✅ Exported %d backups to HTML: %s\n", len(entries), outputPath)
-	fmt.Printf("   Open in browser: file://%s\n", filepath.Join(os.Getenv("PWD"), exportOutput))
-	return nil
-}
-
-// exportJSON exports entries to JSON format
-func exportJSON(entries []*catalog.Entry, outputPath string) error {
-	file, err := os.Create(outputPath)
-	if err != nil {
-		return fmt.Errorf("failed to create output file: %w", err)
-	}
-	defer file.Close()
-
-	encoder := json.NewEncoder(file)
-	encoder.SetIndent("", "  ")
-
-	if err := encoder.Encode(entries); err != nil {
-		return fmt.Errorf("failed to encode JSON: %w", err)
-	}
-
-	fmt.Printf("✅ Exported %d backups to JSON: %s\n", len(entries), outputPath)
-	return nil
-}
-
-// formatTime formats *time.Time to string
-func formatTime(t *time.Time) string {
-	if t == nil {
-		return ""
-	}
-	return t.Format(time.RFC3339)
-}
-
-// formatBool formats *bool to string
-func formatBool(b *bool) string {
-	if b == nil {
-		return ""
-	}
-	if *b {
-		return "true"
-	}
-	return "false"
-}
-
-// formatTimeSpan formats a duration in human-readable form
-func formatTimeSpan(d time.Duration) string {
-	days := int(d.Hours() / 24)
-	if days > 365 {
-		years := days / 365
-		return fmt.Sprintf("%d years", years)
-	}
-	if days > 30 {
-		months := days / 30
-		return fmt.Sprintf("%d months", months)
-	}
-	if days > 0 {
-		return fmt.Sprintf("%d days", days)
-	}
-	return fmt.Sprintf("%.0f hours", d.Hours())
-}

cmd/chain.go

@@ -1,298 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"time"
-
-	"dbbackup/internal/catalog"
-
-	"github.com/spf13/cobra"
-)
-
-var chainCmd = &cobra.Command{
-	Use:   "chain [database]",
-	Short: "Show backup chain (full → incremental)",
-	Long: `Display the backup chain showing the relationship between full and incremental backups.
-
-This command helps understand:
-  - Which incremental backups depend on which full backup
-  - Backup sequence and timeline
-  - Gaps in the backup chain
-  - Total size of backup chain
-
-The backup chain is crucial for:
-  - Point-in-Time Recovery (PITR)
-  - Understanding restore dependencies
-  - Identifying orphaned incremental backups
-  - Planning backup retention
-
-Examples:
-  # Show chain for specific database
-  dbbackup chain mydb
-
-  # Show all backup chains
-  dbbackup chain --all
-
-  # JSON output for automation
-  dbbackup chain mydb --format json
-
-  # Show detailed chain with metadata
-  dbbackup chain mydb --verbose`,
-	Args: cobra.MaximumNArgs(1),
-	RunE: runChain,
-}
-
-var (
-	chainFormat  string
-	chainAll     bool
-	chainVerbose bool
-)
-
-func init() {
-	rootCmd.AddCommand(chainCmd)
-	chainCmd.Flags().StringVar(&chainFormat, "format", "table", "Output format (table, json)")
-	chainCmd.Flags().BoolVar(&chainAll, "all", false, "Show chains for all databases")
-	chainCmd.Flags().BoolVar(&chainVerbose, "verbose", false, "Show detailed information")
-}
-
-type BackupChain struct {
-	Database      string           `json:"database"`
-	FullBackup    *catalog.Entry   `json:"full_backup"`
-	Incrementals  []*catalog.Entry `json:"incrementals"`
-	TotalSize     int64            `json:"total_size"`
-	TotalBackups  int              `json:"total_backups"`
-	OldestBackup  time.Time        `json:"oldest_backup"`
-	NewestBackup  time.Time        `json:"newest_backup"`
-	ChainDuration time.Duration    `json:"chain_duration"`
-	Incomplete    bool             `json:"incomplete"` // true if incrementals without full backup
-}
-
-func runChain(cmd *cobra.Command, args []string) error {
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	var chains []*BackupChain
-
-	if chainAll || len(args) == 0 {
-		// Get all databases
-		databases, err := cat.ListDatabases(ctx)
-		if err != nil {
-			return err
-		}
-
-		for _, db := range databases {
-			chain, err := buildBackupChain(ctx, cat, db)
-			if err != nil {
-				return err
-			}
-			if chain != nil && chain.TotalBackups > 0 {
-				chains = append(chains, chain)
-			}
-		}
-
-		if len(chains) == 0 {
-			fmt.Println("No backup chains found.")
-			fmt.Println("\nRun 'dbbackup catalog sync <directory>' to import backups into catalog.")
-			return nil
-		}
-	} else {
-		// Specific database
-		database := args[0]
-		chain, err := buildBackupChain(ctx, cat, database)
-		if err != nil {
-			return err
-		}
-
-		if chain == nil || chain.TotalBackups == 0 {
-			fmt.Printf("No backups found for database: %s\n", database)
-			return nil
-		}
-
-		chains = append(chains, chain)
-	}
-
-	// Output based on format
-	if chainFormat == "json" {
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(chains)
-	}
-
-	// Table format
-	outputChainTable(chains)
-	return nil
-}
-
-func buildBackupChain(ctx context.Context, cat *catalog.SQLiteCatalog, database string) (*BackupChain, error) {
-	// Query all backups for this database, ordered by creation time
-	query := &catalog.SearchQuery{
-		Database:  database,
-		Limit:     1000,
-		OrderBy:   "created_at",
-		OrderDesc: false,
-	}
-
-	entries, err := cat.Search(ctx, query)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(entries) == 0 {
-		return nil, nil
-	}
-
-	chain := &BackupChain{
-		Database:     database,
-		Incrementals: []*catalog.Entry{},
-	}
-
-	var totalSize int64
-	var oldest, newest time.Time
-
-	// Find full backups and incrementals
-	for _, entry := range entries {
-		totalSize += entry.SizeBytes
-
-		if oldest.IsZero() || entry.CreatedAt.Before(oldest) {
-			oldest = entry.CreatedAt
-		}
-		if newest.IsZero() || entry.CreatedAt.After(newest) {
-			newest = entry.CreatedAt
-		}
-
-		// Check backup type
-		backupType := entry.BackupType
-		if backupType == "" {
-			backupType = "full" // default to full if not specified
-		}
-
-		if backupType == "full" {
-			// Use most recent full backup as base
-			if chain.FullBackup == nil || entry.CreatedAt.After(chain.FullBackup.CreatedAt) {
-				chain.FullBackup = entry
-			}
-		} else if backupType == "incremental" {
-			chain.Incrementals = append(chain.Incrementals, entry)
-		}
-	}
-
-	chain.TotalSize = totalSize
-	chain.TotalBackups = len(entries)
-	chain.OldestBackup = oldest
-	chain.NewestBackup = newest
-	if !oldest.IsZero() && !newest.IsZero() {
-		chain.ChainDuration = newest.Sub(oldest)
-	}
-
-	// Check if incomplete (incrementals without full backup)
-	if len(chain.Incrementals) > 0 && chain.FullBackup == nil {
-		chain.Incomplete = true
-	}
-
-	return chain, nil
-}
-
-func outputChainTable(chains []*BackupChain) {
-	fmt.Println()
-	fmt.Println("Backup Chains")
-	fmt.Println("=====================================================")
-
-	for _, chain := range chains {
-		fmt.Printf("\n[DIR] %s\n", chain.Database)
-
-		if chain.Incomplete {
-			fmt.Println("  [WARN] INCOMPLETE CHAIN - No full backup found!")
-		}
-
-		if chain.FullBackup != nil {
-			fmt.Printf("  [BASE] Full Backup:\n")
-			fmt.Printf("    Created: %s\n", chain.FullBackup.CreatedAt.Format("2006-01-02 15:04:05"))
-			fmt.Printf("    Size:    %s\n", catalog.FormatSize(chain.FullBackup.SizeBytes))
-			if chainVerbose {
-				fmt.Printf("    Path:    %s\n", chain.FullBackup.BackupPath)
-				if chain.FullBackup.SHA256 != "" {
-					fmt.Printf("    SHA256:  %s\n", chain.FullBackup.SHA256[:16]+"...")
-				}
-			}
-		}
-
-		if len(chain.Incrementals) > 0 {
-			fmt.Printf("\n  [CHAIN] Incremental Backups: %d\n", len(chain.Incrementals))
-			for i, inc := range chain.Incrementals {
-				if chainVerbose || i < 5 {
-					fmt.Printf("    %d. %s - %s\n",
-						i+1,
-						inc.CreatedAt.Format("2006-01-02 15:04"),
-						catalog.FormatSize(inc.SizeBytes))
-					if chainVerbose && inc.BackupPath != "" {
-						fmt.Printf("       Path: %s\n", inc.BackupPath)
-					}
-				} else if i == 5 {
-					fmt.Printf("    ... and %d more (use --verbose to show all)\n", len(chain.Incrementals)-5)
-					break
-				}
-			}
-		} else if chain.FullBackup != nil {
-			fmt.Printf("\n  [INFO] No incremental backups (full backup only)\n")
-		}
-
-		// Summary
-		fmt.Printf("\n  [STATS] Chain Summary:\n")
-		fmt.Printf("    Total Backups: %d\n", chain.TotalBackups)
-		fmt.Printf("    Total Size:    %s\n", catalog.FormatSize(chain.TotalSize))
-		if chain.ChainDuration > 0 {
-			fmt.Printf("    Span:          %s (oldest: %s, newest: %s)\n",
-				formatChainDuration(chain.ChainDuration),
-				chain.OldestBackup.Format("2006-01-02"),
-				chain.NewestBackup.Format("2006-01-02"))
-		}
-
-		// Restore info
-		if chain.FullBackup != nil && len(chain.Incrementals) > 0 {
-			fmt.Printf("\n  [INFO] To restore, you need:\n")
-			fmt.Printf("    1. Full backup from %s\n", chain.FullBackup.CreatedAt.Format("2006-01-02"))
-			fmt.Printf("    2. All %d incremental backup(s)\n", len(chain.Incrementals))
-			fmt.Printf("    (Apply in chronological order)\n")
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("=====================================================")
-	fmt.Printf("Total: %d database chain(s)\n", len(chains))
-	fmt.Println()
-
-	// Warnings
-	incompleteCount := 0
-	for _, chain := range chains {
-		if chain.Incomplete {
-			incompleteCount++
-		}
-	}
-	if incompleteCount > 0 {
-		fmt.Printf("\n[WARN] %d incomplete chain(s) detected!\n", incompleteCount)
-		fmt.Println("Incremental backups without a full backup cannot be restored.")
-		fmt.Println("Run a full backup to establish a new base.")
-	}
-}
-
-func formatChainDuration(d time.Duration) string {
-	if d < time.Hour {
-		return fmt.Sprintf("%.0f minutes", d.Minutes())
-	}
-	if d < 24*time.Hour {
-		return fmt.Sprintf("%.1f hours", d.Hours())
-	}
-	days := int(d.Hours() / 24)
-	if days == 1 {
-		return "1 day"
-	}
-	return fmt.Sprintf("%d days", days)
-}

cmd/cloud.go

@@ -30,12 +30,7 @@ Configuration via flags or environment variables:
   --cloud-region        DBBACKUP_CLOUD_REGION
   --cloud-endpoint      DBBACKUP_CLOUD_ENDPOINT
   --cloud-access-key    DBBACKUP_CLOUD_ACCESS_KEY (or AWS_ACCESS_KEY_ID)
-  --cloud-secret-key    DBBACKUP_CLOUD_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)
-  --bandwidth-limit     DBBACKUP_BANDWIDTH_LIMIT
-
-Bandwidth Limiting:
-  Limit upload/download speed to avoid saturating network during business hours.
-  Examples: 10MB/s, 50MiB/s, 100Mbps, unlimited`,
+  --cloud-secret-key    DBBACKUP_CLOUD_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)`,
 }
 
 var cloudUploadCmd = &cobra.Command{
@@ -108,16 +103,15 @@ Examples:
 }
 
 var (
-	cloudProvider       string
-	cloudBucket         string
-	cloudRegion         string
-	cloudEndpoint       string
-	cloudAccessKey      string
-	cloudSecretKey      string
-	cloudPrefix         string
-	cloudVerbose        bool
-	cloudConfirm        bool
-	cloudBandwidthLimit string
+	cloudProvider  string
+	cloudBucket    string
+	cloudRegion    string
+	cloudEndpoint  string
+	cloudAccessKey string
+	cloudSecretKey string
+	cloudPrefix    string
+	cloudVerbose   bool
+	cloudConfirm   bool
 )
 
 func init() {
@@ -125,7 +119,7 @@ func init() {
 	cloudCmd.AddCommand(cloudUploadCmd, cloudDownloadCmd, cloudListCmd, cloudDeleteCmd)
 
 	// Cloud configuration flags
-	for _, cmd := range []*cobra.Command{cloudUploadCmd, cloudDownloadCmd, cloudListCmd, cloudDeleteCmd, cloudStatusCmd} {
+	for _, cmd := range []*cobra.Command{cloudUploadCmd, cloudDownloadCmd, cloudListCmd, cloudDeleteCmd} {
 		cmd.Flags().StringVar(&cloudProvider, "cloud-provider", getEnv("DBBACKUP_CLOUD_PROVIDER", "s3"), "Cloud provider (s3, minio, b2)")
 		cmd.Flags().StringVar(&cloudBucket, "cloud-bucket", getEnv("DBBACKUP_CLOUD_BUCKET", ""), "Bucket name")
 		cmd.Flags().StringVar(&cloudRegion, "cloud-region", getEnv("DBBACKUP_CLOUD_REGION", "us-east-1"), "Region")
@@ -133,7 +127,6 @@ func init() {
 		cmd.Flags().StringVar(&cloudAccessKey, "cloud-access-key", getEnv("DBBACKUP_CLOUD_ACCESS_KEY", getEnv("AWS_ACCESS_KEY_ID", "")), "Access key")
 		cmd.Flags().StringVar(&cloudSecretKey, "cloud-secret-key", getEnv("DBBACKUP_CLOUD_SECRET_KEY", getEnv("AWS_SECRET_ACCESS_KEY", "")), "Secret key")
 		cmd.Flags().StringVar(&cloudPrefix, "cloud-prefix", getEnv("DBBACKUP_CLOUD_PREFIX", ""), "Key prefix")
-		cmd.Flags().StringVar(&cloudBandwidthLimit, "bandwidth-limit", getEnv("DBBACKUP_BANDWIDTH_LIMIT", ""), "Bandwidth limit (e.g., 10MB/s, 100Mbps, 50MiB/s)")
 		cmd.Flags().BoolVarP(&cloudVerbose, "verbose", "v", false, "Verbose output")
 	}
 
@@ -148,40 +141,24 @@ func getEnv(key, defaultValue string) string {
 }
 
 func getCloudBackend() (cloud.Backend, error) {
-	// Parse bandwidth limit
-	var bandwidthLimit int64
-	if cloudBandwidthLimit != "" {
-		var err error
-		bandwidthLimit, err = cloud.ParseBandwidth(cloudBandwidthLimit)
-		if err != nil {
-			return nil, fmt.Errorf("invalid bandwidth limit: %w", err)
-		}
-	}
-
 	cfg := &cloud.Config{
-		Provider:       cloudProvider,
-		Bucket:         cloudBucket,
-		Region:         cloudRegion,
-		Endpoint:       cloudEndpoint,
-		AccessKey:      cloudAccessKey,
-		SecretKey:      cloudSecretKey,
-		Prefix:         cloudPrefix,
-		UseSSL:         true,
-		PathStyle:      cloudProvider == "minio",
-		Timeout:        300,
-		MaxRetries:     3,
-		BandwidthLimit: bandwidthLimit,
+		Provider:   cloudProvider,
+		Bucket:     cloudBucket,
+		Region:     cloudRegion,
+		Endpoint:   cloudEndpoint,
+		AccessKey:  cloudAccessKey,
+		SecretKey:  cloudSecretKey,
+		Prefix:     cloudPrefix,
+		UseSSL:     true,
+		PathStyle:  cloudProvider == "minio",
+		Timeout:    300,
+		MaxRetries: 3,
 	}
 
 	if cfg.Bucket == "" {
 		return nil, fmt.Errorf("bucket name is required (use --cloud-bucket or DBBACKUP_CLOUD_BUCKET)")
 	}
 
-	// Log bandwidth limit if set
-	if bandwidthLimit > 0 {
-		fmt.Printf("📊 Bandwidth limit: %s\n", cloud.FormatBandwidth(bandwidthLimit))
-	}
-
 	backend, err := cloud.NewBackend(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create cloud backend: %w", err)

cmd/cloud_status.go

@@ -1,460 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"time"
-
-	"dbbackup/internal/cloud"
-
-	"github.com/spf13/cobra"
-)
-
-var cloudStatusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "Check cloud storage connectivity and status",
-	Long: `Check cloud storage connectivity, credentials, and bucket access.
-
-This command verifies:
-  - Cloud provider configuration
-  - Authentication/credentials
-  - Bucket/container existence and access
-  - List capabilities (read permissions)
-  - Upload capabilities (write permissions)
-  - Network connectivity
-  - Response times
-
-Supports:
-  - AWS S3
-  - Google Cloud Storage (GCS)
-  - Azure Blob Storage
-  - MinIO
-  - Backblaze B2
-
-Examples:
-  # Check configured cloud storage
-  dbbackup cloud status
-
-  # Check with JSON output
-  dbbackup cloud status --format json
-
-  # Quick check (skip upload test)
-  dbbackup cloud status --quick
-
-  # Verbose diagnostics
-  dbbackup cloud status --verbose`,
-	RunE: runCloudStatus,
-}
-
-var (
-	cloudStatusFormat string
-	cloudStatusQuick  bool
-	// cloudStatusVerbose uses the global cloudVerbose flag from cloud.go
-)
-
-type CloudStatus struct {
-	Provider     string                 `json:"provider"`
-	Bucket       string                 `json:"bucket"`
-	Region       string                 `json:"region,omitempty"`
-	Endpoint     string                 `json:"endpoint,omitempty"`
-	Connected    bool                   `json:"connected"`
-	BucketExists bool                   `json:"bucket_exists"`
-	CanList      bool                   `json:"can_list"`
-	CanUpload    bool                   `json:"can_upload"`
-	ObjectCount  int                    `json:"object_count,omitempty"`
-	TotalSize    int64                  `json:"total_size_bytes,omitempty"`
-	LatencyMs    int64                  `json:"latency_ms,omitempty"`
-	Error        string                 `json:"error,omitempty"`
-	Checks       []CloudStatusCheck     `json:"checks"`
-	Details      map[string]interface{} `json:"details,omitempty"`
-}
-
-type CloudStatusCheck struct {
-	Name    string `json:"name"`
-	Status  string `json:"status"` // "pass", "fail", "skip"
-	Message string `json:"message,omitempty"`
-	Error   string `json:"error,omitempty"`
-}
-
-func init() {
-	cloudCmd.AddCommand(cloudStatusCmd)
-
-	cloudStatusCmd.Flags().StringVar(&cloudStatusFormat, "format", "table", "Output format (table, json)")
-	cloudStatusCmd.Flags().BoolVar(&cloudStatusQuick, "quick", false, "Quick check (skip upload test)")
-	// Note: verbose flag is added by cloud.go init()
-}
-
-func runCloudStatus(cmd *cobra.Command, args []string) error {
-	if !cfg.CloudEnabled {
-		fmt.Println("[WARN] Cloud storage is not enabled")
-		fmt.Println("Enable with: --cloud-enabled")
-		fmt.Println()
-		fmt.Println("Example configuration:")
-		fmt.Println("  cloud_enabled = true")
-		fmt.Println("  cloud_provider = \"s3\"        # s3, gcs, azure, minio, b2")
-		fmt.Println("  cloud_bucket = \"my-backups\"")
-		fmt.Println("  cloud_region = \"us-east-1\"   # for S3/GCS")
-		fmt.Println("  cloud_access_key = \"...\"")
-		fmt.Println("  cloud_secret_key = \"...\"")
-		return nil
-	}
-
-	status := &CloudStatus{
-		Provider: cfg.CloudProvider,
-		Bucket:   cfg.CloudBucket,
-		Region:   cfg.CloudRegion,
-		Endpoint: cfg.CloudEndpoint,
-		Checks:   []CloudStatusCheck{},
-		Details:  make(map[string]interface{}),
-	}
-
-	fmt.Println("[CHECK] Cloud Storage Status")
-	fmt.Println()
-	fmt.Printf("Provider: %s\n", cfg.CloudProvider)
-	fmt.Printf("Bucket:   %s\n", cfg.CloudBucket)
-	if cfg.CloudRegion != "" {
-		fmt.Printf("Region:   %s\n", cfg.CloudRegion)
-	}
-	if cfg.CloudEndpoint != "" {
-		fmt.Printf("Endpoint: %s\n", cfg.CloudEndpoint)
-	}
-	fmt.Println()
-
-	// Check configuration
-	checkConfig(status)
-
-	// Initialize cloud storage
-	ctx := context.Background()
-
-	startTime := time.Now()
-
-	// Create cloud config
-	cloudCfg := &cloud.Config{
-		Provider:   cfg.CloudProvider,
-		Bucket:     cfg.CloudBucket,
-		Region:     cfg.CloudRegion,
-		Endpoint:   cfg.CloudEndpoint,
-		AccessKey:  cfg.CloudAccessKey,
-		SecretKey:  cfg.CloudSecretKey,
-		UseSSL:     true,
-		PathStyle:  cfg.CloudProvider == "minio",
-		Prefix:     cfg.CloudPrefix,
-		Timeout:    300,
-		MaxRetries: 3,
-	}
-
-	backend, err := cloud.NewBackend(cloudCfg)
-	if err != nil {
-		status.Connected = false
-		status.Error = fmt.Sprintf("Failed to initialize cloud storage: %v", err)
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Initialize",
-			Status: "fail",
-			Error:  err.Error(),
-		})
-
-		printStatus(status)
-		return fmt.Errorf("cloud storage initialization failed: %w", err)
-	}
-
-	initDuration := time.Since(startTime)
-	status.Details["init_time_ms"] = initDuration.Milliseconds()
-
-	if cloudVerbose {
-		fmt.Printf("[DEBUG] Initialization took %s\n", initDuration.Round(time.Millisecond))
-	}
-
-	status.Connected = true
-	status.Checks = append(status.Checks, CloudStatusCheck{
-		Name:    "Initialize",
-		Status:  "pass",
-		Message: fmt.Sprintf("Connected (%s)", initDuration.Round(time.Millisecond)),
-	})
-
-	// Test bucket existence (via list operation)
-	checkBucketAccess(ctx, backend, status)
-
-	// Test list permissions
-	checkListPermissions(ctx, backend, status)
-
-	// Test upload permissions (unless quick mode)
-	if !cloudStatusQuick {
-		checkUploadPermissions(ctx, backend, status)
-	} else {
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:    "Upload",
-			Status:  "skip",
-			Message: "Skipped (--quick mode)",
-		})
-	}
-
-	// Calculate overall latency
-	totalLatency := int64(0)
-	for _, check := range status.Checks {
-		if check.Status == "pass" {
-			totalLatency++
-		}
-	}
-	if totalLatency > 0 {
-		status.LatencyMs = initDuration.Milliseconds()
-	}
-
-	// Output results
-	if cloudStatusFormat == "json" {
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(status)
-	}
-
-	printStatus(status)
-
-	// Return error if any checks failed
-	for _, check := range status.Checks {
-		if check.Status == "fail" {
-			return fmt.Errorf("cloud status check failed")
-		}
-	}
-
-	return nil
-}
-
-func checkConfig(status *CloudStatus) {
-	if status.Provider == "" {
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Configuration",
-			Status: "fail",
-			Error:  "Cloud provider not configured",
-		})
-		return
-	}
-
-	if status.Bucket == "" {
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Configuration",
-			Status: "fail",
-			Error:  "Bucket/container name not configured",
-		})
-		return
-	}
-
-	status.Checks = append(status.Checks, CloudStatusCheck{
-		Name:    "Configuration",
-		Status:  "pass",
-		Message: fmt.Sprintf("%s / %s", status.Provider, status.Bucket),
-	})
-}
-
-func checkBucketAccess(ctx context.Context, backend cloud.Backend, status *CloudStatus) {
-	fmt.Print("[TEST] Checking bucket access... ")
-
-	startTime := time.Now()
-	// Try to list - this will fail if bucket doesn't exist or no access
-	_, err := backend.List(ctx, "")
-	duration := time.Since(startTime)
-
-	if err != nil {
-		fmt.Printf("[FAIL] %v\n", err)
-		status.BucketExists = false
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Bucket Access",
-			Status: "fail",
-			Error:  err.Error(),
-		})
-		return
-	}
-
-	fmt.Printf("[OK] (%s)\n", duration.Round(time.Millisecond))
-	status.BucketExists = true
-	status.Checks = append(status.Checks, CloudStatusCheck{
-		Name:    "Bucket Access",
-		Status:  "pass",
-		Message: fmt.Sprintf("Accessible (%s)", duration.Round(time.Millisecond)),
-	})
-}
-
-func checkListPermissions(ctx context.Context, backend cloud.Backend, status *CloudStatus) {
-	fmt.Print("[TEST] Checking list permissions... ")
-
-	startTime := time.Now()
-	objects, err := backend.List(ctx, cfg.CloudPrefix)
-	duration := time.Since(startTime)
-
-	if err != nil {
-		fmt.Printf("[FAIL] %v\n", err)
-		status.CanList = false
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "List Objects",
-			Status: "fail",
-			Error:  err.Error(),
-		})
-		return
-	}
-
-	fmt.Printf("[OK] Found %d object(s) (%s)\n", len(objects), duration.Round(time.Millisecond))
-	status.CanList = true
-	status.ObjectCount = len(objects)
-
-	// Calculate total size
-	var totalSize int64
-	for _, obj := range objects {
-		totalSize += obj.Size
-	}
-	status.TotalSize = totalSize
-
-	status.Checks = append(status.Checks, CloudStatusCheck{
-		Name:    "List Objects",
-		Status:  "pass",
-		Message: fmt.Sprintf("%d objects, %s total (%s)", len(objects), formatCloudBytes(totalSize), duration.Round(time.Millisecond)),
-	})
-
-	if cloudVerbose && len(objects) > 0 {
-		fmt.Println("\n[OBJECTS]")
-		limit := 5
-		for i, obj := range objects {
-			if i >= limit {
-				fmt.Printf("  ... and %d more\n", len(objects)-limit)
-				break
-			}
-			fmt.Printf("  %s (%s, %s)\n", obj.Key, formatCloudBytes(obj.Size), obj.LastModified.Format("2006-01-02 15:04"))
-		}
-		fmt.Println()
-	}
-}
-
-func checkUploadPermissions(ctx context.Context, backend cloud.Backend, status *CloudStatus) {
-	fmt.Print("[TEST] Checking upload permissions... ")
-
-	// Create a small test file
-	testKey := cfg.CloudPrefix + "/.dbbackup-test-" + time.Now().Format("20060102150405")
-	testData := []byte("dbbackup cloud status test")
-
-	// Create temp file for upload
-	tmpFile, err := os.CreateTemp("", "dbbackup-test-*")
-	if err != nil {
-		fmt.Printf("[FAIL] Could not create test file: %v\n", err)
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Upload Test",
-			Status: "fail",
-			Error:  fmt.Sprintf("temp file creation failed: %v", err),
-		})
-		return
-	}
-	defer os.Remove(tmpFile.Name())
-
-	if _, err := tmpFile.Write(testData); err != nil {
-		tmpFile.Close()
-		fmt.Printf("[FAIL] Could not write test file: %v\n", err)
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Upload Test",
-			Status: "fail",
-			Error:  fmt.Sprintf("test file write failed: %v", err),
-		})
-		return
-	}
-	tmpFile.Close()
-
-	startTime := time.Now()
-	err = backend.Upload(ctx, tmpFile.Name(), testKey, nil)
-	uploadDuration := time.Since(startTime)
-
-	if err != nil {
-		fmt.Printf("[FAIL] %v\n", err)
-		status.CanUpload = false
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Upload Test",
-			Status: "fail",
-			Error:  err.Error(),
-		})
-		return
-	}
-
-	fmt.Printf("[OK] Test file uploaded (%s)\n", uploadDuration.Round(time.Millisecond))
-
-	// Try to delete the test file
-	fmt.Print("[TEST] Checking delete permissions... ")
-	deleteStartTime := time.Now()
-	err = backend.Delete(ctx, testKey)
-	deleteDuration := time.Since(deleteStartTime)
-
-	if err != nil {
-		fmt.Printf("[WARN] Could not delete test file: %v\n", err)
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:    "Upload Test",
-			Status:  "pass",
-			Message: fmt.Sprintf("Upload OK (%s), delete failed", uploadDuration.Round(time.Millisecond)),
-		})
-	} else {
-		fmt.Printf("[OK] Test file deleted (%s)\n", deleteDuration.Round(time.Millisecond))
-		status.CanUpload = true
-		status.Checks = append(status.Checks, CloudStatusCheck{
-			Name:   "Upload/Delete Test",
-			Status: "pass",
-			Message: fmt.Sprintf("Both successful (upload: %s, delete: %s)",
-				uploadDuration.Round(time.Millisecond),
-				deleteDuration.Round(time.Millisecond)),
-		})
-	}
-}
-
-func printStatus(status *CloudStatus) {
-	fmt.Println("\n[RESULTS]")
-	fmt.Println("================================================")
-
-	for _, check := range status.Checks {
-		var statusStr string
-		switch check.Status {
-		case "pass":
-			statusStr = "[OK]  "
-		case "fail":
-			statusStr = "[FAIL]"
-		case "skip":
-			statusStr = "[SKIP]"
-		}
-
-		fmt.Printf("  %-20s %s", check.Name+":", statusStr)
-		if check.Message != "" {
-			fmt.Printf(" %s", check.Message)
-		}
-		if check.Error != "" {
-			fmt.Printf(" - %s", check.Error)
-		}
-		fmt.Println()
-	}
-
-	fmt.Println("================================================")
-
-	if status.CanList && status.ObjectCount > 0 {
-		fmt.Printf("\nStorage Usage: %d object(s), %s total\n", status.ObjectCount, formatCloudBytes(status.TotalSize))
-	}
-
-	// Overall status
-	fmt.Println()
-	allPassed := true
-	for _, check := range status.Checks {
-		if check.Status == "fail" {
-			allPassed = false
-			break
-		}
-	}
-
-	if allPassed {
-		fmt.Println("[OK] All checks passed - cloud storage is ready")
-	} else {
-		fmt.Println("[FAIL] Some checks failed - review configuration")
-	}
-}
-
-func formatCloudBytes(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}

cmd/cloud_sync.go

@@ -1,335 +0,0 @@
-// Package cmd - cloud sync command
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"dbbackup/internal/cloud"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	syncDryRun       bool
-	syncDelete       bool
-	syncNewerOnly    bool
-	syncDatabaseFilter string
-)
-
-var cloudSyncCmd = &cobra.Command{
-	Use:   "sync [local-dir]",
-	Short: "Sync local backups to cloud storage",
-	Long: `Sync local backup directory with cloud storage.
-
-Uploads new and updated backups to cloud, optionally deleting
-files in cloud that no longer exist locally.
-
-Examples:
-  # Sync backup directory to cloud
-  dbbackup cloud sync /backups
-
-  # Dry run - show what would be synced
-  dbbackup cloud sync /backups --dry-run
-
-  # Sync and delete orphaned cloud files
-  dbbackup cloud sync /backups --delete
-
-  # Only upload newer files
-  dbbackup cloud sync /backups --newer-only
-
-  # Sync specific database backups
-  dbbackup cloud sync /backups --database mydb`,
-	Args: cobra.ExactArgs(1),
-	RunE: runCloudSync,
-}
-
-func init() {
-	cloudCmd.AddCommand(cloudSyncCmd)
-
-	// Sync-specific flags
-	cloudSyncCmd.Flags().BoolVar(&syncDryRun, "dry-run", false, "Show what would be synced without uploading")
-	cloudSyncCmd.Flags().BoolVar(&syncDelete, "delete", false, "Delete cloud files that don't exist locally")
-	cloudSyncCmd.Flags().BoolVar(&syncNewerOnly, "newer-only", false, "Only upload files newer than cloud version")
-	cloudSyncCmd.Flags().StringVar(&syncDatabaseFilter, "database", "", "Only sync backups for specific database")
-
-	// Cloud configuration flags
-	cloudSyncCmd.Flags().StringVar(&cloudProvider, "cloud-provider", getEnv("DBBACKUP_CLOUD_PROVIDER", "s3"), "Cloud provider (s3, minio, b2)")
-	cloudSyncCmd.Flags().StringVar(&cloudBucket, "cloud-bucket", getEnv("DBBACKUP_CLOUD_BUCKET", ""), "Bucket name")
-	cloudSyncCmd.Flags().StringVar(&cloudRegion, "cloud-region", getEnv("DBBACKUP_CLOUD_REGION", "us-east-1"), "Region")
-	cloudSyncCmd.Flags().StringVar(&cloudEndpoint, "cloud-endpoint", getEnv("DBBACKUP_CLOUD_ENDPOINT", ""), "Custom endpoint (for MinIO)")
-	cloudSyncCmd.Flags().StringVar(&cloudAccessKey, "cloud-access-key", getEnv("DBBACKUP_CLOUD_ACCESS_KEY", getEnv("AWS_ACCESS_KEY_ID", "")), "Access key")
-	cloudSyncCmd.Flags().StringVar(&cloudSecretKey, "cloud-secret-key", getEnv("DBBACKUP_CLOUD_SECRET_KEY", getEnv("AWS_SECRET_ACCESS_KEY", "")), "Secret key")
-	cloudSyncCmd.Flags().StringVar(&cloudPrefix, "cloud-prefix", getEnv("DBBACKUP_CLOUD_PREFIX", ""), "Key prefix")
-	cloudSyncCmd.Flags().StringVar(&cloudBandwidthLimit, "bandwidth-limit", getEnv("DBBACKUP_BANDWIDTH_LIMIT", ""), "Bandwidth limit (e.g., 10MB/s, 100Mbps)")
-	cloudSyncCmd.Flags().BoolVarP(&cloudVerbose, "verbose", "v", false, "Verbose output")
-}
-
-type syncAction struct {
-	Action   string // "upload", "skip", "delete"
-	Filename string
-	Size     int64
-	Reason   string
-}
-
-func runCloudSync(cmd *cobra.Command, args []string) error {
-	localDir := args[0]
-
-	// Validate local directory
-	info, err := os.Stat(localDir)
-	if err != nil {
-		return fmt.Errorf("cannot access directory: %w", err)
-	}
-	if !info.IsDir() {
-		return fmt.Errorf("not a directory: %s", localDir)
-	}
-
-	backend, err := getCloudBackend()
-	if err != nil {
-		return err
-	}
-
-	ctx := context.Background()
-
-	fmt.Println()
-	fmt.Println("╔═══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║                    Cloud Sync                                  ║")
-	fmt.Println("╠═══════════════════════════════════════════════════════════════╣")
-	fmt.Printf("║  Local:   %-52s ║\n", truncateSyncString(localDir, 52))
-	fmt.Printf("║  Cloud:   %-52s ║\n", truncateSyncString(fmt.Sprintf("%s/%s", backend.Name(), cloudBucket), 52))
-	if syncDryRun {
-		fmt.Println("║  Mode:    DRY RUN (no changes will be made)                   ║")
-	}
-	fmt.Println("╚═══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-
-	// Get local files
-	localFiles := make(map[string]os.FileInfo)
-	err = filepath.Walk(localDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.IsDir() {
-			return nil
-		}
-
-		// Only include backup files
-		ext := strings.ToLower(filepath.Ext(path))
-		if !isSyncBackupFile(ext) {
-			return nil
-		}
-
-		// Apply database filter
-		if syncDatabaseFilter != "" && !strings.Contains(filepath.Base(path), syncDatabaseFilter) {
-			return nil
-		}
-
-		relPath, _ := filepath.Rel(localDir, path)
-		localFiles[relPath] = info
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("failed to scan local directory: %w", err)
-	}
-
-	// Get cloud files
-	cloudBackups, err := backend.List(ctx, cloudPrefix)
-	if err != nil {
-		return fmt.Errorf("failed to list cloud files: %w", err)
-	}
-
-	cloudFiles := make(map[string]cloud.BackupInfo)
-	for _, b := range cloudBackups {
-		cloudFiles[b.Name] = b
-	}
-
-	// Analyze sync actions
-	var actions []syncAction
-	var uploadCount, skipCount, deleteCount int
-	var uploadSize int64
-
-	// Check local files
-	for filename, info := range localFiles {
-		cloudInfo, existsInCloud := cloudFiles[filename]
-
-		if !existsInCloud {
-			// New file - needs upload
-			actions = append(actions, syncAction{
-				Action:   "upload",
-				Filename: filename,
-				Size:     info.Size(),
-				Reason:   "new file",
-			})
-			uploadCount++
-			uploadSize += info.Size()
-		} else if syncNewerOnly {
-			// Check if local is newer
-			if info.ModTime().After(cloudInfo.LastModified) {
-				actions = append(actions, syncAction{
-					Action:   "upload",
-					Filename: filename,
-					Size:     info.Size(),
-					Reason:   "local is newer",
-				})
-				uploadCount++
-				uploadSize += info.Size()
-			} else {
-				actions = append(actions, syncAction{
-					Action:   "skip",
-					Filename: filename,
-					Size:     info.Size(),
-					Reason:   "cloud is up to date",
-				})
-				skipCount++
-			}
-		} else {
-			// Check by size (simpler than hash)
-			if info.Size() != cloudInfo.Size {
-				actions = append(actions, syncAction{
-					Action:   "upload",
-					Filename: filename,
-					Size:     info.Size(),
-					Reason:   "size mismatch",
-				})
-				uploadCount++
-				uploadSize += info.Size()
-			} else {
-				actions = append(actions, syncAction{
-					Action:   "skip",
-					Filename: filename,
-					Size:     info.Size(),
-					Reason:   "already synced",
-				})
-				skipCount++
-			}
-		}
-	}
-
-	// Check for cloud files to delete
-	if syncDelete {
-		for cloudFile := range cloudFiles {
-			if _, existsLocally := localFiles[cloudFile]; !existsLocally {
-				actions = append(actions, syncAction{
-					Action:   "delete",
-					Filename: cloudFile,
-					Size:     cloudFiles[cloudFile].Size,
-					Reason:   "not in local",
-				})
-				deleteCount++
-			}
-		}
-	}
-
-	// Show summary
-	fmt.Printf("📊 Sync Summary\n")
-	fmt.Printf("   Local files:  %d\n", len(localFiles))
-	fmt.Printf("   Cloud files:  %d\n", len(cloudFiles))
-	fmt.Printf("   To upload:    %d (%s)\n", uploadCount, cloud.FormatSize(uploadSize))
-	fmt.Printf("   To skip:      %d\n", skipCount)
-	if syncDelete {
-		fmt.Printf("   To delete:    %d\n", deleteCount)
-	}
-	fmt.Println()
-
-	if uploadCount == 0 && deleteCount == 0 {
-		fmt.Println("✅ Already in sync - nothing to do!")
-		return nil
-	}
-
-	// Verbose action list
-	if cloudVerbose || syncDryRun {
-		fmt.Println("📋 Actions:")
-		for _, action := range actions {
-			if action.Action == "skip" && !cloudVerbose {
-				continue
-			}
-			icon := "📤"
-			if action.Action == "skip" {
-				icon = "⏭️"
-			} else if action.Action == "delete" {
-				icon = "🗑️"
-			}
-			fmt.Printf("   %s %-8s %-40s (%s)\n", icon, action.Action, truncateSyncString(action.Filename, 40), action.Reason)
-		}
-		fmt.Println()
-	}
-
-	if syncDryRun {
-		fmt.Println("🔍 Dry run complete - no changes made")
-		return nil
-	}
-
-	// Execute sync
-	fmt.Println("🚀 Starting sync...")
-	fmt.Println()
-
-	var successUploads, successDeletes int
-	var failedUploads, failedDeletes int
-
-	for _, action := range actions {
-		switch action.Action {
-		case "upload":
-			localPath := filepath.Join(localDir, action.Filename)
-			fmt.Printf("📤 Uploading: %s\n", action.Filename)
-
-			err := backend.Upload(ctx, localPath, action.Filename, nil)
-			if err != nil {
-				fmt.Printf("   ❌ Failed: %v\n", err)
-				failedUploads++
-			} else {
-				fmt.Printf("   ✅ Done (%s)\n", cloud.FormatSize(action.Size))
-				successUploads++
-			}
-
-		case "delete":
-			fmt.Printf("🗑️ Deleting: %s\n", action.Filename)
-
-			err := backend.Delete(ctx, action.Filename)
-			if err != nil {
-				fmt.Printf("   ❌ Failed: %v\n", err)
-				failedDeletes++
-			} else {
-				fmt.Printf("   ✅ Deleted\n")
-				successDeletes++
-			}
-		}
-	}
-
-	// Final summary
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-	fmt.Printf("✅ Sync Complete\n")
-	fmt.Printf("   Uploaded: %d/%d\n", successUploads, uploadCount)
-	if syncDelete {
-		fmt.Printf("   Deleted:  %d/%d\n", successDeletes, deleteCount)
-	}
-	if failedUploads > 0 || failedDeletes > 0 {
-		fmt.Printf("   ⚠️ Failures: %d\n", failedUploads+failedDeletes)
-	}
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-
-	return nil
-}
-
-func isSyncBackupFile(ext string) bool {
-	backupExts := []string{
-		".dump", ".sql", ".gz", ".xz", ".zst",
-		".backup", ".bak", ".dmp",
-	}
-	for _, e := range backupExts {
-		if ext == e {
-			return true
-		}
-	}
-	return false
-}
-
-func truncateSyncString(s string, max int) string {
-	if len(s) <= max {
-		return s
-	}
-	return s[:max-3] + "..."
-}

cmd/completion.go

@@ -1,80 +0,0 @@
-package cmd
-
-import (
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-var completionCmd = &cobra.Command{
-	Use:   "completion [bash|zsh|fish|powershell]",
-	Short: "Generate shell completion scripts",
-	Long: `Generate shell completion scripts for dbbackup commands.
-
-The completion script allows tab-completion of:
-- Commands and subcommands
-- Flags and their values
-- File paths for backup/restore operations
-
-Installation Instructions:
-
-Bash:
-  # Add to ~/.bashrc or ~/.bash_profile:
-  source <(dbbackup completion bash)
-  
-  # Or save to file and source it:
-  dbbackup completion bash > ~/.dbbackup-completion.bash
-  echo 'source ~/.dbbackup-completion.bash' >> ~/.bashrc
-
-Zsh:
-  # Add to ~/.zshrc:
-  source <(dbbackup completion zsh)
-  
-  # Or save to completion directory:
-  dbbackup completion zsh > "${fpath[1]}/_dbbackup"
-  
-  # For custom location:
-  dbbackup completion zsh > ~/.dbbackup-completion.zsh
-  echo 'source ~/.dbbackup-completion.zsh' >> ~/.zshrc
-
-Fish:
-  # Save to fish completion directory:
-  dbbackup completion fish > ~/.config/fish/completions/dbbackup.fish
-
-PowerShell:
-  # Add to your PowerShell profile:
-  dbbackup completion powershell | Out-String | Invoke-Expression
-  
-  # Or save to profile:
-  dbbackup completion powershell >> $PROFILE
-
-After installation, restart your shell or source the completion file.
-
-Note: Some flags may have conflicting shorthand letters across different
-subcommands (e.g., -d for both db-type and database). Tab completion will
-work correctly for the command you're using.`,
-	ValidArgs:          []string{"bash", "zsh", "fish", "powershell"},
-	Args:               cobra.ExactArgs(1),
-	DisableFlagParsing: true, // Don't parse flags for completion generation
-	Run: func(cmd *cobra.Command, args []string) {
-		shell := args[0]
-
-		// Get root command without triggering flag merging
-		root := cmd.Root()
-
-		switch shell {
-		case "bash":
-			root.GenBashCompletionV2(os.Stdout, true)
-		case "zsh":
-			root.GenZshCompletion(os.Stdout)
-		case "fish":
-			root.GenFishCompletion(os.Stdout, true)
-		case "powershell":
-			root.GenPowerShellCompletionWithDesc(os.Stdout)
-		}
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(completionCmd)
-}

cmd/cost.go

@@ -1,396 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"dbbackup/internal/catalog"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	costDatabase string
-	costFormat   string
-	costRegion   string
-	costProvider string
-	costDays     int
-)
-
-// costCmd analyzes backup storage costs
-var costCmd = &cobra.Command{
-	Use:   "cost",
-	Short: "Analyze cloud storage costs for backups",
-	Long: `Calculate and compare cloud storage costs for your backups.
-
-Analyzes storage costs across providers:
-  - AWS S3 (Standard, IA, Glacier, Deep Archive)
-  - Google Cloud Storage (Standard, Nearline, Coldline, Archive)
-  - Azure Blob Storage (Hot, Cool, Archive)
-  - Backblaze B2
-  - Wasabi
-
-Pricing is based on standard rates and may vary by region.
-
-Examples:
-  # Analyze all backups
-  dbbackup cost analyze
-
-  # Specific database
-  dbbackup cost analyze --database mydb
-
-  # Compare providers for 90 days
-  dbbackup cost analyze --days 90 --format table
-
-  # Estimate for specific region
-  dbbackup cost analyze --region us-east-1
-
-  # JSON output for automation
-  dbbackup cost analyze --format json`,
-}
-
-var costAnalyzeCmd = &cobra.Command{
-	Use:   "analyze",
-	Short: "Analyze backup storage costs",
-	Args:  cobra.NoArgs,
-	RunE:  runCostAnalyze,
-}
-
-func init() {
-	rootCmd.AddCommand(costCmd)
-	costCmd.AddCommand(costAnalyzeCmd)
-
-	costAnalyzeCmd.Flags().StringVar(&costDatabase, "database", "", "Filter by database")
-	costAnalyzeCmd.Flags().StringVar(&costFormat, "format", "table", "Output format (table, json)")
-	costAnalyzeCmd.Flags().StringVar(&costRegion, "region", "us-east-1", "Cloud region for pricing")
-	costAnalyzeCmd.Flags().StringVar(&costProvider, "provider", "all", "Show specific provider (all, aws, gcs, azure, b2, wasabi)")
-	costAnalyzeCmd.Flags().IntVar(&costDays, "days", 30, "Number of days to calculate")
-}
-
-func runCostAnalyze(cmd *cobra.Command, args []string) error {
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Get backup statistics
-	var stats *catalog.Stats
-	if costDatabase != "" {
-		stats, err = cat.StatsByDatabase(ctx, costDatabase)
-	} else {
-		stats, err = cat.Stats(ctx)
-	}
-	if err != nil {
-		return err
-	}
-
-	if stats.TotalBackups == 0 {
-		fmt.Println("No backups found in catalog. Run 'dbbackup catalog sync' first.")
-		return nil
-	}
-
-	// Calculate costs
-	analysis := calculateCosts(stats.TotalSize, costDays, costRegion)
-
-	if costFormat == "json" {
-		return outputCostJSON(analysis, stats)
-	}
-
-	return outputCostTable(analysis, stats)
-}
-
-// StorageTier represents a storage class/tier
-type StorageTier struct {
-	Provider    string
-	Tier        string
-	Description string
-	StorageGB   float64 // $ per GB/month
-	RetrievalGB float64 // $ per GB retrieved
-	Requests    float64 // $ per 1000 requests
-	MinDays     int     // Minimum storage duration
-}
-
-// CostAnalysis represents the cost breakdown
-type CostAnalysis struct {
-	TotalSizeGB    float64
-	Days           int
-	Region         string
-	Recommendations []TierRecommendation
-}
-
-type TierRecommendation struct {
-	Provider       string
-	Tier           string
-	Description    string
-	MonthlyStorage float64
-	AnnualStorage  float64
-	RetrievalCost  float64
-	TotalMonthly   float64
-	TotalAnnual    float64
-	SavingsVsS3    float64
-	SavingsPct     float64
-	BestFor        string
-}
-
-func calculateCosts(totalBytes int64, days int, region string) *CostAnalysis {
-	sizeGB := float64(totalBytes) / (1024 * 1024 * 1024)
-	
-	analysis := &CostAnalysis{
-		TotalSizeGB: sizeGB,
-		Days:        days,
-		Region:      region,
-	}
-
-	// Define storage tiers (pricing as of 2026, approximate)
-	tiers := []StorageTier{
-		// AWS S3
-		{Provider: "AWS S3", Tier: "Standard", Description: "Frequent access", 
-			StorageGB: 0.023, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "AWS S3", Tier: "Intelligent-Tiering", Description: "Auto-optimization",
-			StorageGB: 0.023, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "AWS S3", Tier: "Standard-IA", Description: "Infrequent access",
-			StorageGB: 0.0125, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "AWS S3", Tier: "Glacier Instant", Description: "Archive instant",
-			StorageGB: 0.004, RetrievalGB: 0.03, Requests: 0.01, MinDays: 90},
-		{Provider: "AWS S3", Tier: "Glacier Flexible", Description: "Archive flexible",
-			StorageGB: 0.0036, RetrievalGB: 0.02, Requests: 0.05, MinDays: 90},
-		{Provider: "AWS S3", Tier: "Deep Archive", Description: "Long-term archive",
-			StorageGB: 0.00099, RetrievalGB: 0.02, Requests: 0.05, MinDays: 180},
-		
-		// Google Cloud Storage
-		{Provider: "GCS", Tier: "Standard", Description: "Frequent access",
-			StorageGB: 0.020, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "GCS", Tier: "Nearline", Description: "Monthly access",
-			StorageGB: 0.010, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "GCS", Tier: "Coldline", Description: "Quarterly access",
-			StorageGB: 0.004, RetrievalGB: 0.02, Requests: 0.005, MinDays: 90},
-		{Provider: "GCS", Tier: "Archive", Description: "Annual access",
-			StorageGB: 0.0012, RetrievalGB: 0.05, Requests: 0.05, MinDays: 365},
-		
-		// Azure Blob Storage
-		{Provider: "Azure", Tier: "Hot", Description: "Frequent access",
-			StorageGB: 0.0184, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "Azure", Tier: "Cool", Description: "Infrequent access",
-			StorageGB: 0.010, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "Azure", Tier: "Archive", Description: "Long-term archive",
-			StorageGB: 0.00099, RetrievalGB: 0.02, Requests: 0.05, MinDays: 180},
-		
-		// Backblaze B2
-		{Provider: "Backblaze B2", Tier: "Standard", Description: "Affordable cloud",
-			StorageGB: 0.005, RetrievalGB: 0.01, Requests: 0.0004, MinDays: 0},
-		
-		// Wasabi
-		{Provider: "Wasabi", Tier: "Hot Cloud", Description: "No egress fees",
-			StorageGB: 0.0059, RetrievalGB: 0.0, Requests: 0.0, MinDays: 90},
-	}
-
-	// Calculate costs for each tier
-	s3StandardCost := 0.0
-	for _, tier := range tiers {
-		if costProvider != "all" {
-			providerLower := strings.ToLower(tier.Provider)
-			filterLower := strings.ToLower(costProvider)
-			if !strings.Contains(providerLower, filterLower) {
-				continue
-			}
-		}
-
-		rec := TierRecommendation{
-			Provider:    tier.Provider,
-			Tier:        tier.Tier,
-			Description: tier.Description,
-		}
-
-		// Monthly storage cost
-		rec.MonthlyStorage = sizeGB * tier.StorageGB
-
-		// Annual storage cost
-		rec.AnnualStorage = rec.MonthlyStorage * 12
-
-		// Estimate retrieval cost (assume 1 retrieval per month for DR testing)
-		rec.RetrievalCost = sizeGB * tier.RetrievalGB
-
-		// Total costs
-		rec.TotalMonthly = rec.MonthlyStorage + rec.RetrievalCost
-		rec.TotalAnnual = rec.AnnualStorage + (rec.RetrievalCost * 12)
-
-		// Track S3 Standard for comparison
-		if tier.Provider == "AWS S3" && tier.Tier == "Standard" {
-			s3StandardCost = rec.TotalMonthly
-		}
-
-		// Recommendations
-		switch {
-		case tier.MinDays >= 180:
-			rec.BestFor = "Long-term archives (6+ months)"
-		case tier.MinDays >= 90:
-			rec.BestFor = "Compliance archives (3+ months)"
-		case tier.MinDays >= 30:
-			rec.BestFor = "Recent backups (monthly rotation)"
-		default:
-			rec.BestFor = "Active/hot backups (daily access)"
-		}
-
-		analysis.Recommendations = append(analysis.Recommendations, rec)
-	}
-
-	// Calculate savings vs S3 Standard
-	if s3StandardCost > 0 {
-		for i := range analysis.Recommendations {
-			rec := &analysis.Recommendations[i]
-			rec.SavingsVsS3 = s3StandardCost - rec.TotalMonthly
-			if s3StandardCost > 0 {
-				rec.SavingsPct = (rec.SavingsVsS3 / s3StandardCost) * 100.0
-			}
-		}
-	}
-
-	return analysis
-}
-
-func outputCostTable(analysis *CostAnalysis, stats *catalog.Stats) error {
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Printf("  Cloud Storage Cost Analysis\n")
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	fmt.Printf("[CURRENT BACKUP INVENTORY]\n")
-	fmt.Printf("  Total Backups:     %d\n", stats.TotalBackups)
-	fmt.Printf("  Total Size:        %.2f GB (%s)\n", analysis.TotalSizeGB, stats.TotalSizeHuman)
-	if costDatabase != "" {
-		fmt.Printf("  Database:          %s\n", costDatabase)
-	} else {
-		fmt.Printf("  Databases:         %d\n", len(stats.ByDatabase))
-	}
-	fmt.Printf("  Region:            %s\n", analysis.Region)
-	fmt.Printf("  Analysis Period:   %d days\n", analysis.Days)
-	fmt.Println()
-
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-	fmt.Printf("%-20s %-20s %12s %12s %12s\n", 
-		"PROVIDER", "TIER", "MONTHLY", "ANNUAL", "SAVINGS")
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-
-	for _, rec := range analysis.Recommendations {
-		savings := ""
-		if rec.SavingsVsS3 > 0 {
-			savings = fmt.Sprintf("↓ $%.2f (%.0f%%)", rec.SavingsVsS3, rec.SavingsPct)
-		} else if rec.SavingsVsS3 < 0 {
-			savings = fmt.Sprintf("↑ $%.2f", -rec.SavingsVsS3)
-		} else {
-			savings = "baseline"
-		}
-
-		fmt.Printf("%-20s %-20s $%10.2f $%10.2f  %s\n",
-			rec.Provider,
-			rec.Tier,
-			rec.TotalMonthly,
-			rec.TotalAnnual,
-			savings,
-		)
-	}
-
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-	fmt.Println()
-
-	// Top recommendations
-	fmt.Println("[COST OPTIMIZATION RECOMMENDATIONS]")
-	fmt.Println()
-
-	// Find cheapest option
-	cheapest := analysis.Recommendations[0]
-	for _, rec := range analysis.Recommendations {
-		if rec.TotalAnnual < cheapest.TotalAnnual {
-			cheapest = rec
-		}
-	}
-
-	fmt.Printf("💰 CHEAPEST OPTION: %s %s\n", cheapest.Provider, cheapest.Tier)
-	fmt.Printf("   Annual Cost: $%.2f (save $%.2f/year vs S3 Standard)\n", 
-		cheapest.TotalAnnual, cheapest.SavingsVsS3*12)
-	fmt.Printf("   Best For: %s\n", cheapest.BestFor)
-	fmt.Println()
-
-	// Find best balance
-	fmt.Printf("⚖️  BALANCED OPTION: AWS S3 Standard-IA or GCS Nearline\n")
-	fmt.Printf("   Good balance of cost and accessibility\n")
-	fmt.Printf("   Suitable for 30-day retention backups\n")
-	fmt.Println()
-
-	// Find hot storage
-	fmt.Printf("🔥 HOT STORAGE: Wasabi or Backblaze B2\n")
-	fmt.Printf("   No egress fees (Wasabi) or low retrieval costs\n")
-	fmt.Printf("   Perfect for frequent restore testing\n")
-	fmt.Println()
-
-	// Strategy recommendation
-	fmt.Println("[TIERED STORAGE STRATEGY]")
-	fmt.Println()
-	fmt.Printf("   Day 0-7:     S3 Standard or Wasabi        (frequent access)\n")
-	fmt.Printf("   Day 8-30:    S3 Standard-IA or GCS Nearline  (weekly access)\n")
-	fmt.Printf("   Day 31-90:   S3 Glacier or GCS Coldline      (monthly access)\n")
-	fmt.Printf("   Day 90+:     S3 Deep Archive or GCS Archive  (compliance)\n")
-	fmt.Println()
-
-	potentialSaving := 0.0
-	for _, rec := range analysis.Recommendations {
-		if rec.Provider == "AWS S3" && rec.Tier == "Deep Archive" {
-			potentialSaving = rec.SavingsVsS3 * 12
-		}
-	}
-
-	if potentialSaving > 0 {
-		fmt.Printf("💡 With tiered lifecycle policies, you could save ~$%.2f/year\n", potentialSaving)
-	}
-
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Println()
-	fmt.Println("Note: Costs are estimates based on standard pricing.")
-	fmt.Println("Actual costs may vary by region, usage patterns, and current pricing.")
-	fmt.Println()
-
-	return nil
-}
-
-func outputCostJSON(analysis *CostAnalysis, stats *catalog.Stats) error {
-	output := map[string]interface{}{
-		"inventory": map[string]interface{}{
-			"total_backups":     stats.TotalBackups,
-			"total_size_gb":     analysis.TotalSizeGB,
-			"total_size_human":  stats.TotalSizeHuman,
-			"region":            analysis.Region,
-			"analysis_days":     analysis.Days,
-		},
-		"recommendations": analysis.Recommendations,
-	}
-
-	// Find cheapest
-	cheapest := analysis.Recommendations[0]
-	for _, rec := range analysis.Recommendations {
-		if rec.TotalAnnual < cheapest.TotalAnnual {
-			cheapest = rec
-		}
-	}
-
-	output["cheapest"] = map[string]interface{}{
-		"provider":     cheapest.Provider,
-		"tier":         cheapest.Tier,
-		"annual_cost":  cheapest.TotalAnnual,
-		"monthly_cost": cheapest.TotalMonthly,
-	}
-
-	data, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Println(string(data))
-	return nil
-}

cmd/cross_region_sync.go

@@ -1,499 +0,0 @@
-// Package cmd - cross-region sync command
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"dbbackup/internal/cloud"
-	"dbbackup/internal/logger"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	// Source cloud configuration
-	sourceProvider  string
-	sourceBucket    string
-	sourceRegion    string
-	sourceEndpoint  string
-	sourceAccessKey string
-	sourceSecretKey string
-	sourcePrefix    string
-
-	// Destination cloud configuration
-	destProvider  string
-	destBucket    string
-	destRegion    string
-	destEndpoint  string
-	destAccessKey string
-	destSecretKey string
-	destPrefix    string
-
-	// Sync options
-	crossSyncDryRun    bool
-	crossSyncDelete    bool
-	crossSyncNewerOnly bool
-	crossSyncParallel  int
-	crossSyncFilterDB  string
-	crossSyncFilterAge int // days
-)
-
-var crossRegionSyncCmd = &cobra.Command{
-	Use:   "cross-region-sync",
-	Short: "Sync backups between cloud regions",
-	Long: `Sync backups from one cloud region to another for disaster recovery.
-
-This command copies backups from a source cloud storage location to a 
-destination cloud storage location, which can be in a different region,
-provider, or even different cloud service.
-
-Use Cases:
-- Geographic redundancy (EU → US, Asia → EU)
-- Provider redundancy (AWS → GCS, Azure → S3)
-- Cost optimization (Standard → Archive tier)
-- Compliance (keep copies in specific regions)
-
-Examples:
-  # Sync S3 us-east-1 to us-west-2
-  dbbackup cross-region-sync \
-    --source-provider s3 --source-bucket prod-backups --source-region us-east-1 \
-    --dest-provider s3 --dest-bucket dr-backups --dest-region us-west-2
-
-  # Dry run to preview what would be copied
-  dbbackup cross-region-sync --dry-run \
-    --source-provider s3 --source-bucket backups --source-region eu-west-1 \
-    --dest-provider gcs --dest-bucket backups-dr --dest-region us-central1
-
-  # Sync with deletion of orphaned files
-  dbbackup cross-region-sync --delete \
-    --source-provider s3 --source-bucket primary \
-    --dest-provider s3 --dest-bucket secondary
-
-  # Sync only recent backups (last 30 days)
-  dbbackup cross-region-sync --age 30 \
-    --source-provider azure --source-bucket backups \
-    --dest-provider s3 --dest-bucket dr-backups
-
-  # Sync specific database with parallel uploads
-  dbbackup cross-region-sync --database mydb --parallel 3 \
-    --source-provider s3 --source-bucket prod \
-    --dest-provider s3 --dest-bucket dr
-
-  # Use environment variables for credentials
-  export DBBACKUP_SOURCE_ACCESS_KEY=xxx
-  export DBBACKUP_SOURCE_SECRET_KEY=xxx
-  export DBBACKUP_DEST_ACCESS_KEY=yyy
-  export DBBACKUP_DEST_SECRET_KEY=yyy
-  dbbackup cross-region-sync \
-    --source-provider s3 --source-bucket prod --source-region us-east-1 \
-    --dest-provider s3 --dest-bucket dr --dest-region us-west-2`,
-	RunE: runCrossRegionSync,
-}
-
-func init() {
-	cloudCmd.AddCommand(crossRegionSyncCmd)
-
-	// Source configuration
-	crossRegionSyncCmd.Flags().StringVar(&sourceProvider, "source-provider", getEnv("DBBACKUP_SOURCE_PROVIDER", "s3"), "Source cloud provider (s3, minio, b2, azure, gcs)")
-	crossRegionSyncCmd.Flags().StringVar(&sourceBucket, "source-bucket", getEnv("DBBACKUP_SOURCE_BUCKET", ""), "Source bucket/container name")
-	crossRegionSyncCmd.Flags().StringVar(&sourceRegion, "source-region", getEnv("DBBACKUP_SOURCE_REGION", ""), "Source region")
-	crossRegionSyncCmd.Flags().StringVar(&sourceEndpoint, "source-endpoint", getEnv("DBBACKUP_SOURCE_ENDPOINT", ""), "Source custom endpoint (for MinIO/B2)")
-	crossRegionSyncCmd.Flags().StringVar(&sourceAccessKey, "source-access-key", getEnv("DBBACKUP_SOURCE_ACCESS_KEY", ""), "Source access key")
-	crossRegionSyncCmd.Flags().StringVar(&sourceSecretKey, "source-secret-key", getEnv("DBBACKUP_SOURCE_SECRET_KEY", ""), "Source secret key")
-	crossRegionSyncCmd.Flags().StringVar(&sourcePrefix, "source-prefix", getEnv("DBBACKUP_SOURCE_PREFIX", ""), "Source path prefix")
-
-	// Destination configuration
-	crossRegionSyncCmd.Flags().StringVar(&destProvider, "dest-provider", getEnv("DBBACKUP_DEST_PROVIDER", "s3"), "Destination cloud provider (s3, minio, b2, azure, gcs)")
-	crossRegionSyncCmd.Flags().StringVar(&destBucket, "dest-bucket", getEnv("DBBACKUP_DEST_BUCKET", ""), "Destination bucket/container name")
-	crossRegionSyncCmd.Flags().StringVar(&destRegion, "dest-region", getEnv("DBBACKUP_DEST_REGION", ""), "Destination region")
-	crossRegionSyncCmd.Flags().StringVar(&destEndpoint, "dest-endpoint", getEnv("DBBACKUP_DEST_ENDPOINT", ""), "Destination custom endpoint (for MinIO/B2)")
-	crossRegionSyncCmd.Flags().StringVar(&destAccessKey, "dest-access-key", getEnv("DBBACKUP_DEST_ACCESS_KEY", ""), "Destination access key")
-	crossRegionSyncCmd.Flags().StringVar(&destSecretKey, "dest-secret-key", getEnv("DBBACKUP_DEST_SECRET_KEY", ""), "Destination secret key")
-	crossRegionSyncCmd.Flags().StringVar(&destPrefix, "dest-prefix", getEnv("DBBACKUP_DEST_PREFIX", ""), "Destination path prefix")
-
-	// Sync options
-	crossRegionSyncCmd.Flags().BoolVar(&crossSyncDryRun, "dry-run", false, "Preview what would be synced without copying")
-	crossRegionSyncCmd.Flags().BoolVar(&crossSyncDelete, "delete", false, "Delete destination files that don't exist in source")
-	crossRegionSyncCmd.Flags().BoolVar(&crossSyncNewerOnly, "newer-only", false, "Only copy files newer than destination version")
-	crossRegionSyncCmd.Flags().IntVar(&crossSyncParallel, "parallel", 2, "Number of parallel transfers")
-	crossRegionSyncCmd.Flags().StringVar(&crossSyncFilterDB, "database", "", "Only sync backups for specific database")
-	crossRegionSyncCmd.Flags().IntVar(&crossSyncFilterAge, "age", 0, "Only sync backups from last N days (0 = all)")
-
-	// Mark required flags
-	crossRegionSyncCmd.MarkFlagRequired("source-bucket")
-	crossRegionSyncCmd.MarkFlagRequired("dest-bucket")
-}
-
-func runCrossRegionSync(cmd *cobra.Command, args []string) error {
-	ctx := context.Background()
-
-	// Validate configuration
-	if sourceBucket == "" {
-		return fmt.Errorf("source bucket is required")
-	}
-	if destBucket == "" {
-		return fmt.Errorf("destination bucket is required")
-	}
-
-	// Create source backend
-	sourceBackend, err := createCloudBackend("source", &cloud.Config{
-		Provider:  sourceProvider,
-		Bucket:    sourceBucket,
-		Region:    sourceRegion,
-		Endpoint:  sourceEndpoint,
-		AccessKey: sourceAccessKey,
-		SecretKey: sourceSecretKey,
-		Prefix:    sourcePrefix,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to create source backend: %w", err)
-	}
-
-	// Create destination backend
-	destBackend, err := createCloudBackend("destination", &cloud.Config{
-		Provider:  destProvider,
-		Bucket:    destBucket,
-		Region:    destRegion,
-		Endpoint:  destEndpoint,
-		AccessKey: destAccessKey,
-		SecretKey: destSecretKey,
-		Prefix:    destPrefix,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to create destination backend: %w", err)
-	}
-
-	// Display configuration
-	fmt.Printf("Cross-Region Sync Configuration\n")
-	fmt.Printf("================================\n\n")
-	fmt.Printf("Source:\n")
-	fmt.Printf("  Provider: %s\n", sourceProvider)
-	fmt.Printf("  Bucket:   %s\n", sourceBucket)
-	if sourceRegion != "" {
-		fmt.Printf("  Region:   %s\n", sourceRegion)
-	}
-	if sourcePrefix != "" {
-		fmt.Printf("  Prefix:   %s\n", sourcePrefix)
-	}
-	fmt.Printf("\nDestination:\n")
-	fmt.Printf("  Provider: %s\n", destProvider)
-	fmt.Printf("  Bucket:   %s\n", destBucket)
-	if destRegion != "" {
-		fmt.Printf("  Region:   %s\n", destRegion)
-	}
-	if destPrefix != "" {
-		fmt.Printf("  Prefix:   %s\n", destPrefix)
-	}
-	fmt.Printf("\nOptions:\n")
-	fmt.Printf("  Parallel: %d\n", crossSyncParallel)
-	if crossSyncFilterDB != "" {
-		fmt.Printf("  Database: %s\n", crossSyncFilterDB)
-	}
-	if crossSyncFilterAge > 0 {
-		fmt.Printf("  Age:      last %d days\n", crossSyncFilterAge)
-	}
-	if crossSyncDryRun {
-		fmt.Printf("  Mode:     DRY RUN (no changes will be made)\n")
-	}
-	fmt.Printf("\n")
-
-	// List source backups
-	logger.Info("Listing source backups...")
-	sourceBackups, err := sourceBackend.List(ctx, "")
-	if err != nil {
-		return fmt.Errorf("failed to list source backups: %w", err)
-	}
-
-	// Apply filters
-	sourceBackups = filterBackups(sourceBackups, crossSyncFilterDB, crossSyncFilterAge)
-
-	if len(sourceBackups) == 0 {
-		fmt.Printf("No backups found in source matching filters\n")
-		return nil
-	}
-
-	fmt.Printf("Found %d backups in source\n", len(sourceBackups))
-
-	// List destination backups
-	logger.Info("Listing destination backups...")
-	destBackups, err := destBackend.List(ctx, "")
-	if err != nil {
-		return fmt.Errorf("failed to list destination backups: %w", err)
-	}
-
-	fmt.Printf("Found %d backups in destination\n\n", len(destBackups))
-
-	// Build destination map for quick lookup
-	destMap := make(map[string]cloud.BackupInfo)
-	for _, backup := range destBackups {
-		destMap[backup.Name] = backup
-	}
-
-	// Determine what needs to be copied
-	var toCopy []cloud.BackupInfo
-	var toDelete []cloud.BackupInfo
-
-	for _, srcBackup := range sourceBackups {
-		destBackup, existsInDest := destMap[srcBackup.Name]
-
-		if !existsInDest {
-			// File doesn't exist in destination - needs copy
-			toCopy = append(toCopy, srcBackup)
-		} else if crossSyncNewerOnly && srcBackup.LastModified.After(destBackup.LastModified) {
-			// Newer file in source - needs copy
-			toCopy = append(toCopy, srcBackup)
-		} else if !crossSyncNewerOnly && srcBackup.Size != destBackup.Size {
-			// Size mismatch - needs copy
-			toCopy = append(toCopy, srcBackup)
-		}
-
-		// Mark as found in source
-		delete(destMap, srcBackup.Name)
-	}
-
-	// Remaining files in destMap are orphaned (exist in dest but not in source)
-	if crossSyncDelete {
-		for _, backup := range destMap {
-			toDelete = append(toDelete, backup)
-		}
-	}
-
-	// Sort for consistent output
-	sort.Slice(toCopy, func(i, j int) bool {
-		return toCopy[i].Name < toCopy[j].Name
-	})
-	sort.Slice(toDelete, func(i, j int) bool {
-		return toDelete[i].Name < toDelete[j].Name
-	})
-
-	// Display sync plan
-	fmt.Printf("Sync Plan\n")
-	fmt.Printf("=========\n\n")
-
-	if len(toCopy) > 0 {
-		totalSize := int64(0)
-		for _, backup := range toCopy {
-			totalSize += backup.Size
-		}
-		fmt.Printf("To Copy: %d files (%s)\n", len(toCopy), cloud.FormatSize(totalSize))
-		if len(toCopy) <= 10 {
-			for _, backup := range toCopy {
-				fmt.Printf("  - %s (%s)\n", backup.Name, cloud.FormatSize(backup.Size))
-			}
-		} else {
-			for i := 0; i < 5; i++ {
-				fmt.Printf("  - %s (%s)\n", toCopy[i].Name, cloud.FormatSize(toCopy[i].Size))
-			}
-			fmt.Printf("  ... and %d more files\n", len(toCopy)-5)
-		}
-		fmt.Printf("\n")
-	} else {
-		fmt.Printf("To Copy: 0 files (all in sync)\n\n")
-	}
-
-	if crossSyncDelete && len(toDelete) > 0 {
-		totalSize := int64(0)
-		for _, backup := range toDelete {
-			totalSize += backup.Size
-		}
-		fmt.Printf("To Delete: %d files (%s)\n", len(toDelete), cloud.FormatSize(totalSize))
-		if len(toDelete) <= 10 {
-			for _, backup := range toDelete {
-				fmt.Printf("  - %s (%s)\n", backup.Name, cloud.FormatSize(backup.Size))
-			}
-		} else {
-			for i := 0; i < 5; i++ {
-				fmt.Printf("  - %s (%s)\n", toDelete[i].Name, cloud.FormatSize(toDelete[i].Size))
-			}
-			fmt.Printf("  ... and %d more files\n", len(toDelete)-5)
-		}
-		fmt.Printf("\n")
-	}
-
-	if crossSyncDryRun {
-		fmt.Printf("DRY RUN - No changes made\n")
-		return nil
-	}
-
-	if len(toCopy) == 0 && len(toDelete) == 0 {
-		fmt.Printf("Nothing to sync\n")
-		return nil
-	}
-
-	// Confirm if not in dry-run mode
-	fmt.Printf("Proceed with sync? (y/n): ")
-	var response string
-	fmt.Scanln(&response)
-	if !strings.HasPrefix(strings.ToLower(response), "y") {
-		fmt.Printf("Sync cancelled\n")
-		return nil
-	}
-
-	fmt.Printf("\n")
-
-	// Execute copies
-	if len(toCopy) > 0 {
-		fmt.Printf("Copying files...\n")
-		if err := copyBackups(ctx, sourceBackend, destBackend, toCopy, crossSyncParallel); err != nil {
-			return fmt.Errorf("copy failed: %w", err)
-		}
-		fmt.Printf("\n")
-	}
-
-	// Execute deletions
-	if crossSyncDelete && len(toDelete) > 0 {
-		fmt.Printf("Deleting orphaned files...\n")
-		if err := deleteBackups(ctx, destBackend, toDelete); err != nil {
-			return fmt.Errorf("delete failed: %w", err)
-		}
-		fmt.Printf("\n")
-	}
-
-	fmt.Printf("Sync completed successfully\n")
-	return nil
-}
-
-func createCloudBackend(label string, cfg *cloud.Config) (cloud.Backend, error) {
-	if cfg.Bucket == "" {
-		return nil, fmt.Errorf("%s bucket is required", label)
-	}
-
-	// Set defaults
-	if cfg.MaxRetries == 0 {
-		cfg.MaxRetries = 3
-	}
-	if cfg.Timeout == 0 {
-		cfg.Timeout = 300
-	}
-	cfg.UseSSL = true
-
-	backend, err := cloud.NewBackend(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create %s backend: %w", label, err)
-	}
-
-	return backend, nil
-}
-
-func filterBackups(backups []cloud.BackupInfo, database string, ageInDays int) []cloud.BackupInfo {
-	filtered := make([]cloud.BackupInfo, 0, len(backups))
-
-	cutoffTime := time.Time{}
-	if ageInDays > 0 {
-		cutoffTime = time.Now().AddDate(0, 0, -ageInDays)
-	}
-
-	for _, backup := range backups {
-		// Filter by database name
-		if database != "" && !strings.Contains(backup.Name, database) {
-			continue
-		}
-
-		// Filter by age
-		if ageInDays > 0 && backup.LastModified.Before(cutoffTime) {
-			continue
-		}
-
-		filtered = append(filtered, backup)
-	}
-
-	return filtered
-}
-
-func copyBackups(ctx context.Context, source, dest cloud.Backend, backups []cloud.BackupInfo, parallel int) error {
-	if parallel < 1 {
-		parallel = 1
-	}
-
-	var wg sync.WaitGroup
-	semaphore := make(chan struct{}, parallel)
-	errChan := make(chan error, len(backups))
-
-	successCount := 0
-	var mu sync.Mutex
-
-	for i, backup := range backups {
-		wg.Add(1)
-		go func(idx int, bkp cloud.BackupInfo) {
-			defer wg.Done()
-
-			// Acquire semaphore
-			semaphore <- struct{}{}
-			defer func() { <-semaphore }()
-
-			// Download to temp file
-			tempFile := filepath.Join(os.TempDir(), fmt.Sprintf("dbbackup-sync-%d-%s", idx, filepath.Base(bkp.Key)))
-			defer os.Remove(tempFile)
-
-			// Download from source
-			err := source.Download(ctx, bkp.Key, tempFile, func(transferred, total int64) {
-				// Progress callback - could be enhanced
-			})
-			if err != nil {
-				errChan <- fmt.Errorf("download %s failed: %w", bkp.Name, err)
-				return
-			}
-
-			// Upload to destination
-			err = dest.Upload(ctx, tempFile, bkp.Key, func(transferred, total int64) {
-				// Progress callback - could be enhanced
-			})
-			if err != nil {
-				errChan <- fmt.Errorf("upload %s failed: %w", bkp.Name, err)
-				return
-			}
-
-			mu.Lock()
-			successCount++
-			fmt.Printf("  [%d/%d] Copied %s (%s)\n", successCount, len(backups), bkp.Name, cloud.FormatSize(bkp.Size))
-			mu.Unlock()
-
-		}(i, backup)
-	}
-
-	wg.Wait()
-	close(errChan)
-
-	// Check for errors
-	var errors []error
-	for err := range errChan {
-		errors = append(errors, err)
-	}
-
-	if len(errors) > 0 {
-		fmt.Printf("\nEncountered %d errors during copy:\n", len(errors))
-		for _, err := range errors {
-			fmt.Printf("  - %v\n", err)
-		}
-		return fmt.Errorf("%d files failed to copy", len(errors))
-	}
-
-	return nil
-}
-
-func deleteBackups(ctx context.Context, backend cloud.Backend, backups []cloud.BackupInfo) error {
-	successCount := 0
-
-	for _, backup := range backups {
-		err := backend.Delete(ctx, backup.Key)
-		if err != nil {
-			fmt.Printf("  Failed to delete %s: %v\n", backup.Name, err)
-			continue
-		}
-		successCount++
-		fmt.Printf("  Deleted %s\n", backup.Name)
-	}
-
-	if successCount < len(backups) {
-		return fmt.Errorf("deleted %d/%d files (some failed)", successCount, len(backups))
-	}
-
-	return nil
-}

cmd/dedup.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"compress/gzip"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
@@ -13,7 +14,6 @@ import (
 
 	"dbbackup/internal/dedup"
 
-	"github.com/klauspost/pgzip"
 	"github.com/spf13/cobra"
 )
 
@@ -164,8 +164,8 @@ var (
 
 // metrics flags
 var (
-	dedupMetricsOutput string
-	dedupMetricsServer string
+	dedupMetricsOutput   string
+	dedupMetricsInstance string
 )
 
 var dedupMetricsCmd = &cobra.Command{
@@ -185,15 +185,15 @@ Examples:
 
 // Flags
 var (
-	dedupDir        string
-	dedupIndexDB    string // Separate path for SQLite index (for NFS/CIFS support)
-	dedupCompress   bool
-	dedupEncrypt    bool
-	dedupKey        string
-	dedupName       string
-	dedupDBType     string
-	dedupDBName     string
-	dedupDBHost     string
+	dedupDir       string
+	dedupIndexDB   string // Separate path for SQLite index (for NFS/CIFS support)
+	dedupCompress  bool
+	dedupEncrypt   bool
+	dedupKey       string
+	dedupName      string
+	dedupDBType    string
+	dedupDBName    string
+	dedupDBHost    string
 	dedupDecompress bool // Auto-decompress gzip input
 )
 
@@ -241,7 +241,7 @@ func init() {
 
 	// Metrics flags
 	dedupMetricsCmd.Flags().StringVarP(&dedupMetricsOutput, "output", "o", "", "Output file path (default: stdout)")
-	dedupMetricsCmd.Flags().StringVar(&dedupMetricsServer, "server", "", "Server label for metrics (default: hostname)")
+	dedupMetricsCmd.Flags().StringVar(&dedupMetricsInstance, "instance", "", "Instance label for metrics (default: hostname)")
 }
 
 func getDedupDir() string {
@@ -295,7 +295,7 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 
 	if isGzipped && dedupDecompress {
 		fmt.Printf("Auto-decompressing gzip input for better dedup ratio...\n")
-		gzReader, err := pgzip.NewReader(file)
+		gzReader, err := gzip.NewReader(file)
 		if err != nil {
 			return fmt.Errorf("failed to decompress gzip input: %w", err)
 		}
@@ -596,7 +596,7 @@ func runDedupList(cmd *cobra.Command, args []string) error {
 func runDedupStats(cmd *cobra.Command, args []string) error {
 	basePath := getDedupDir()
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -642,7 +642,7 @@ func runDedupStats(cmd *cobra.Command, args []string) error {
 func runDedupGC(cmd *cobra.Command, args []string) error {
 	basePath := getDedupDir()
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -702,7 +702,7 @@ func runDedupDelete(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to open manifest store: %w", err)
 	}
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -1052,7 +1052,9 @@ func runDedupBackupDB(cmd *cobra.Command, args []string) error {
 		if backupDBUser != "" {
 			dumpArgs = append(dumpArgs, "-u", backupDBUser)
 		}
-		// Password passed via MYSQL_PWD env var (security: avoid process list exposure)
+		if backupDBPassword != "" {
+			dumpArgs = append(dumpArgs, "-p"+backupDBPassword)
+		}
 		dumpArgs = append(dumpArgs, dbName)
 
 	case "mariadb":
@@ -1073,7 +1075,9 @@ func runDedupBackupDB(cmd *cobra.Command, args []string) error {
 		if backupDBUser != "" {
 			dumpArgs = append(dumpArgs, "-u", backupDBUser)
 		}
-		// Password passed via MYSQL_PWD env var (security: avoid process list exposure)
+		if backupDBPassword != "" {
+			dumpArgs = append(dumpArgs, "-p"+backupDBPassword)
+		}
 		dumpArgs = append(dumpArgs, dbName)
 
 	default:
@@ -1127,15 +1131,9 @@ func runDedupBackupDB(cmd *cobra.Command, args []string) error {
 	// Start the dump command
 	dumpExec := exec.Command(dumpCmd, dumpArgs...)
 
-	// Set password via environment (security: avoid process list exposure)
-	dumpExec.Env = os.Environ()
-	if backupDBPassword != "" {
-		switch dbType {
-		case "postgres":
-			dumpExec.Env = append(dumpExec.Env, "PGPASSWORD="+backupDBPassword)
-		case "mysql", "mariadb":
-			dumpExec.Env = append(dumpExec.Env, "MYSQL_PWD="+backupDBPassword)
-		}
+	// Set password via environment for postgres
+	if dbType == "postgres" && backupDBPassword != "" {
+		dumpExec.Env = append(os.Environ(), "PGPASSWORD="+backupDBPassword)
 	}
 
 	stdout, err := dumpExec.StdoutPipe()
@@ -1260,10 +1258,10 @@ func runDedupMetrics(cmd *cobra.Command, args []string) error {
 	basePath := getDedupDir()
 	indexPath := getIndexDBPath()
 
-	server := dedupMetricsServer
-	if server == "" {
+	instance := dedupMetricsInstance
+	if instance == "" {
 		hostname, _ := os.Hostname()
-		server = hostname
+		instance = hostname
 	}
 
 	metrics, err := dedup.CollectMetrics(basePath, indexPath)
@@ -1271,10 +1269,10 @@ func runDedupMetrics(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to collect metrics: %w", err)
 	}
 
-	output := dedup.FormatPrometheusMetrics(metrics, server)
+	output := dedup.FormatPrometheusMetrics(metrics, instance)
 
 	if dedupMetricsOutput != "" {
-		if err := dedup.WritePrometheusTextfile(dedupMetricsOutput, server, basePath, indexPath); err != nil {
+		if err := dedup.WritePrometheusTextfile(dedupMetricsOutput, instance, basePath, indexPath); err != nil {
 			return fmt.Errorf("failed to write metrics: %w", err)
 		}
 		fmt.Printf("Wrote metrics to %s\n", dedupMetricsOutput)

cmd/drill.go

@@ -16,7 +16,8 @@ import (
 )
 
 var (
-	drillDatabaseName string
+	drillBackupPath     string
+	drillDatabaseName   string
 	drillDatabaseType   string
 	drillImage          string
 	drillPort           int

cmd/encryption.go

@@ -7,30 +7,8 @@ import (
 	"strings"
 
 	"dbbackup/internal/crypto"
-
-	"github.com/spf13/cobra"
 )
 
-var encryptionCmd = &cobra.Command{
-	Use:   "encryption",
-	Short: "Encryption key management",
-	Long: `Manage encryption keys for database backups.
-
-This command group provides encryption key management utilities:
-  - rotate: Generate new encryption keys and rotate existing ones
-
-Examples:
-  # Generate new encryption key
-  dbbackup encryption rotate
-
-  # Show rotation workflow
-  dbbackup encryption rotate --show-reencrypt`,
-}
-
-func init() {
-	rootCmd.AddCommand(encryptionCmd)
-}
-
 // loadEncryptionKey loads encryption key from file or environment variable
 func loadEncryptionKey(keyFile, keyEnvVar string) ([]byte, error) {
 	// Priority 1: Key file
@@ -87,3 +65,13 @@ func loadEncryptionKey(keyFile, keyEnvVar string) ([]byte, error) {
 func isEncryptionEnabled() bool {
 	return encryptBackupFlag
 }
+
+// generateEncryptionKey generates a new random encryption key
+func generateEncryptionKey() ([]byte, error) {
+	salt, err := crypto.GenerateSalt()
+	if err != nil {
+		return nil, err
+	}
+	// For key generation, use salt as both password and salt (random)
+	return crypto.DeriveKey(salt, salt), nil
+}

cmd/encryption_rotate.go

@@ -1,226 +0,0 @@
-package cmd
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/spf13/cobra"
-)
-
-var encryptionRotateCmd = &cobra.Command{
-	Use:   "rotate",
-	Short: "Rotate encryption keys",
-	Long: `Generate new encryption keys and provide migration instructions.
-
-This command helps with encryption key management:
-  - Generates new secure encryption keys
-  - Provides safe key rotation workflow
-  - Creates backup of old keys
-  - Shows re-encryption commands for existing backups
-
-Key Rotation Workflow:
-  1. Generate new key with this command
-  2. Back up existing backups with old key
-  3. Update configuration with new key
-  4. Re-encrypt old backups (optional)
-  5. Securely delete old key
-
-Security Best Practices:
-  - Rotate keys every 90-365 days
-  - Never store keys in version control
-  - Use key management systems (AWS KMS, HashiCorp Vault)
-  - Keep old keys until all backups are re-encrypted
-  - Test decryption before deleting old keys
-
-Examples:
-  # Generate new encryption key
-  dbbackup encryption rotate
-
-  # Generate key with specific strength
-  dbbackup encryption rotate --key-size 256
-
-  # Save key to file
-  dbbackup encryption rotate --output /secure/path/new.key
-
-  # Show re-encryption commands
-  dbbackup encryption rotate --show-reencrypt`,
-	RunE: runEncryptionRotate,
-}
-
-var (
-	rotateKeySize       int
-	rotateOutput        string
-	rotateShowReencrypt bool
-	rotateFormat        string
-)
-
-func init() {
-	encryptionCmd.AddCommand(encryptionRotateCmd)
-
-	encryptionRotateCmd.Flags().IntVar(&rotateKeySize, "key-size", 256, "Key size in bits (128, 192, 256)")
-	encryptionRotateCmd.Flags().StringVar(&rotateOutput, "output", "", "Save new key to file (default: display only)")
-	encryptionRotateCmd.Flags().BoolVar(&rotateShowReencrypt, "show-reencrypt", true, "Show re-encryption commands")
-	encryptionRotateCmd.Flags().StringVar(&rotateFormat, "format", "base64", "Key format (base64, hex)")
-}
-
-func runEncryptionRotate(cmd *cobra.Command, args []string) error {
-	fmt.Println("[KEY ROTATION] Encryption Key Management")
-	fmt.Println("=========================================")
-	fmt.Println()
-
-	// Validate key size
-	if rotateKeySize != 128 && rotateKeySize != 192 && rotateKeySize != 256 {
-		return fmt.Errorf("invalid key size: %d (must be 128, 192, or 256)", rotateKeySize)
-	}
-
-	keyBytes := rotateKeySize / 8
-
-	// Generate new key
-	fmt.Printf("[GENERATE] Creating new %d-bit encryption key...\n", rotateKeySize)
-
-	key := make([]byte, keyBytes)
-	if _, err := rand.Read(key); err != nil {
-		return fmt.Errorf("failed to generate random key: %w", err)
-	}
-
-	// Format key
-	var keyString string
-	switch rotateFormat {
-	case "base64":
-		keyString = base64.StdEncoding.EncodeToString(key)
-	case "hex":
-		keyString = fmt.Sprintf("%x", key)
-	default:
-		return fmt.Errorf("invalid format: %s (use base64 or hex)", rotateFormat)
-	}
-
-	fmt.Println("[OK] New encryption key generated")
-	fmt.Println()
-
-	// Display new key
-	fmt.Println("[NEW KEY]")
-	fmt.Println("=========================================")
-	fmt.Printf("Format:    %s\n", rotateFormat)
-	fmt.Printf("Size:      %d bits (%d bytes)\n", rotateKeySize, keyBytes)
-	fmt.Printf("Generated: %s\n", time.Now().Format(time.RFC3339))
-	fmt.Println()
-	fmt.Println("Key:")
-	fmt.Printf("  %s\n", keyString)
-	fmt.Println()
-
-	// Save to file if requested
-	if rotateOutput != "" {
-		if err := saveKeyToFile(rotateOutput, keyString); err != nil {
-			return fmt.Errorf("failed to save key: %w", err)
-		}
-		fmt.Printf("[SAVED] Key written to: %s\n", rotateOutput)
-		fmt.Println("[WARN] Secure this file with proper permissions!")
-		fmt.Printf("       chmod 600 %s\n", rotateOutput)
-		fmt.Println()
-	}
-
-	// Show rotation workflow
-	fmt.Println("[KEY ROTATION WORKFLOW]")
-	fmt.Println("=========================================")
-	fmt.Println()
-	fmt.Println("1. [BACKUP] Back up your old key:")
-	fmt.Println("   export OLD_KEY=\"$DBBACKUP_ENCRYPTION_KEY\"")
-	fmt.Println("   echo $OLD_KEY > /secure/backup/old-key.txt")
-	fmt.Println()
-	fmt.Println("2. [UPDATE] Update your configuration:")
-	if rotateOutput != "" {
-		fmt.Printf("   export DBBACKUP_ENCRYPTION_KEY=$(cat %s)\n", rotateOutput)
-	} else {
-		fmt.Printf("   export DBBACKUP_ENCRYPTION_KEY=\"%s\"\n", keyString)
-	}
-	fmt.Println("   # Or update .dbbackup.conf or systemd environment")
-	fmt.Println()
-	fmt.Println("3. [VERIFY] Test new key with a backup:")
-	fmt.Println("   dbbackup backup single testdb --encryption-key-env DBBACKUP_ENCRYPTION_KEY")
-	fmt.Println()
-	fmt.Println("4. [RE-ENCRYPT] Re-encrypt existing backups (optional):")
-	if rotateShowReencrypt {
-		showReencryptCommands()
-	}
-	fmt.Println()
-	fmt.Println("5. [CLEANUP] After all backups re-encrypted:")
-	fmt.Println("   # Securely delete old key")
-	fmt.Println("   shred -u /secure/backup/old-key.txt")
-	fmt.Println("   unset OLD_KEY")
-	fmt.Println()
-
-	// Security warnings
-	fmt.Println("[SECURITY WARNINGS]")
-	fmt.Println("=========================================")
-	fmt.Println()
-	fmt.Println("⚠  DO NOT store keys in:")
-	fmt.Println("   - Version control (git, svn)")
-	fmt.Println("   - Unencrypted files")
-	fmt.Println("   - Email or chat logs")
-	fmt.Println("   - Shell history (use env vars)")
-	fmt.Println()
-	fmt.Println("✓  DO store keys in:")
-	fmt.Println("   - Hardware Security Modules (HSM)")
-	fmt.Println("   - Key Management Systems (AWS KMS, Vault)")
-	fmt.Println("   - Encrypted password managers")
-	fmt.Println("   - Encrypted environment files (0600 permissions)")
-	fmt.Println()
-	fmt.Println("✓  Key Rotation Schedule:")
-	fmt.Println("   - Production: Every 90 days")
-	fmt.Println("   - Development: Every 180 days")
-	fmt.Println("   - After security incident: Immediately")
-	fmt.Println()
-
-	return nil
-}
-
-func saveKeyToFile(path string, key string) error {
-	// Create directory if needed
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return fmt.Errorf("failed to create directory: %w", err)
-	}
-
-	// Write key file with restricted permissions
-	if err := os.WriteFile(path, []byte(key+"\n"), 0600); err != nil {
-		return fmt.Errorf("failed to write file: %w", err)
-	}
-
-	return nil
-}
-
-func showReencryptCommands() {
-	// Use explicit string to avoid go vet warnings about % in shell parameter expansion
-	pctEnc := "${backup%.enc}"
-	
-	fmt.Println("   # Option A: Re-encrypt with openssl")
-	fmt.Println("   for backup in /path/to/backups/*.enc; do")
-	fmt.Println("     # Decrypt with old key")
-	fmt.Println("     openssl enc -aes-256-cbc -d \\")
-	fmt.Println("       -in \"$backup\" \\")
-	fmt.Printf("       -out \"%s.tmp\" \\\n", pctEnc)
-	fmt.Println("       -k \"$OLD_KEY\"")
-	fmt.Println()
-	fmt.Println("     # Encrypt with new key")
-	fmt.Println("     openssl enc -aes-256-cbc \\")
-	fmt.Printf("       -in \"%s.tmp\" \\\n", pctEnc)
-	fmt.Println("       -out \"${backup}.new\" \\")
-	fmt.Println("       -k \"$DBBACKUP_ENCRYPTION_KEY\"")
-	fmt.Println()
-	fmt.Println("     # Verify and replace")
-	fmt.Println("     if [ -f \"${backup}.new\" ]; then")
-	fmt.Println("       mv \"${backup}.new\" \"$backup\"")
-	fmt.Printf("       rm \"%s.tmp\"\n", pctEnc)
-	fmt.Println("     fi")
-	fmt.Println("   done")
-	fmt.Println()
-	fmt.Println("   # Option B: Decrypt and re-backup")
-	fmt.Println("   # 1. Restore from old encrypted backups")
-	fmt.Println("   # 2. Create new backups with new key")
-	fmt.Println("   # 3. Verify new backups")
-	fmt.Println("   # 4. Delete old backups")
-}

cmd/estimate.go

@@ -1,212 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	"dbbackup/internal/backup"
-)
-
-var (
-	estimateDetailed bool
-	estimateJSON     bool
-)
-
-var estimateCmd = &cobra.Command{
-	Use:   "estimate",
-	Short: "Estimate backup size and duration before running",
-	Long: `Estimate how much disk space and time a backup will require.
-
-This helps plan backup operations and ensure sufficient resources are available.
-The estimation queries database statistics without performing actual backups.
-
-Examples:
-  # Estimate single database backup
-  dbbackup estimate single mydb
-
-  # Estimate full cluster backup
-  dbbackup estimate cluster
-
-  # Detailed estimation with per-database breakdown
-  dbbackup estimate cluster --detailed
-
-  # JSON output for automation
-  dbbackup estimate single mydb --json`,
-}
-
-var estimateSingleCmd = &cobra.Command{
-	Use:   "single [database]",
-	Short: "Estimate single database backup size",
-	Long: `Estimate the size and duration for backing up a single database.
-
-Provides:
-- Raw database size
-- Estimated compressed size
-- Estimated backup duration
-- Required disk space
-- Disk space availability check
-- Recommended backup profile`,
-	Args: cobra.ExactArgs(1),
-	RunE: runEstimateSingle,
-}
-
-var estimateClusterCmd = &cobra.Command{
-	Use:   "cluster",
-	Short: "Estimate full cluster backup size",
-	Long: `Estimate the size and duration for backing up an entire database cluster.
-
-Provides:
-- Total cluster size
-- Per-database breakdown (with --detailed)
-- Estimated total duration (accounting for parallelism)
-- Required disk space
-- Disk space availability check
-
-Uses configured parallelism settings to estimate actual backup time.`,
-	RunE: runEstimateCluster,
-}
-
-func init() {
-	rootCmd.AddCommand(estimateCmd)
-	estimateCmd.AddCommand(estimateSingleCmd)
-	estimateCmd.AddCommand(estimateClusterCmd)
-
-	// Flags for both subcommands
-	estimateCmd.PersistentFlags().BoolVar(&estimateDetailed, "detailed", false, "Show detailed per-database breakdown")
-	estimateCmd.PersistentFlags().BoolVar(&estimateJSON, "json", false, "Output as JSON")
-}
-
-func runEstimateSingle(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(cmd.Context(), 30*time.Second)
-	defer cancel()
-
-	databaseName := args[0]
-
-	fmt.Printf("🔍 Estimating backup size for database: %s\n\n", databaseName)
-
-	estimate, err := backup.EstimateBackupSize(ctx, cfg, log, databaseName)
-	if err != nil {
-		return fmt.Errorf("estimation failed: %w", err)
-	}
-
-	if estimateJSON {
-		// Output JSON
-		fmt.Println(toJSON(estimate))
-	} else {
-		// Human-readable output
-		fmt.Println(backup.FormatSizeEstimate(estimate))
-		fmt.Printf("\n  Estimation completed in %v\n", estimate.EstimationTime)
-
-		// Warning if insufficient space
-		if !estimate.HasSufficientSpace {
-			fmt.Println()
-			fmt.Println("⚠️  WARNING: Insufficient disk space!")
-			fmt.Printf("    Need %s more space to proceed safely.\n",
-				formatBytes(estimate.RequiredDiskSpace-estimate.AvailableDiskSpace))
-			fmt.Println()
-			fmt.Println("    Recommended actions:")
-			fmt.Println("    1. Free up disk space: dbbackup cleanup /backups --retention-days 7")
-			fmt.Println("    2. Use a different backup directory: --backup-dir /other/location")
-			fmt.Println("    3. Increase disk capacity")
-		}
-	}
-
-	return nil
-}
-
-func runEstimateCluster(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(cmd.Context(), 60*time.Second)
-	defer cancel()
-
-	fmt.Println("🔍 Estimating cluster backup size...")
-	fmt.Println()
-
-	estimate, err := backup.EstimateClusterBackupSize(ctx, cfg, log)
-	if err != nil {
-		return fmt.Errorf("estimation failed: %w", err)
-	}
-
-	if estimateJSON {
-		// Output JSON
-		fmt.Println(toJSON(estimate))
-	} else {
-		// Human-readable output
-		fmt.Println(backup.FormatClusterSizeEstimate(estimate))
-
-		// Detailed per-database breakdown
-		if estimateDetailed && len(estimate.DatabaseEstimates) > 0 {
-			fmt.Println()
-			fmt.Println("Per-Database Breakdown:")
-			fmt.Println("════════════════════════════════════════════════════════════")
-
-			// Sort databases by size (largest first)
-			type dbSize struct {
-				name string
-				size int64
-			}
-			var sorted []dbSize
-			for name, est := range estimate.DatabaseEstimates {
-				sorted = append(sorted, dbSize{name, est.EstimatedRawSize})
-			}
-			// Simple sort by size (descending)
-			for i := 0; i < len(sorted)-1; i++ {
-				for j := i + 1; j < len(sorted); j++ {
-					if sorted[j].size > sorted[i].size {
-						sorted[i], sorted[j] = sorted[j], sorted[i]
-					}
-				}
-			}
-
-			// Display top 10 largest
-			displayCount := len(sorted)
-			if displayCount > 10 {
-				displayCount = 10
-			}
-
-			for i := 0; i < displayCount; i++ {
-				name := sorted[i].name
-				est := estimate.DatabaseEstimates[name]
-				fmt.Printf("\n%d. %s\n", i+1, name)
-				fmt.Printf("   Raw: %s | Compressed: %s | Duration: %v\n",
-					formatBytes(est.EstimatedRawSize),
-					formatBytes(est.EstimatedCompressed),
-					est.EstimatedDuration.Round(time.Second))
-				if est.LargestTable != "" {
-					fmt.Printf("   Largest table: %s (%s)\n",
-						est.LargestTable,
-						formatBytes(est.LargestTableSize))
-				}
-			}
-
-			if len(sorted) > 10 {
-				fmt.Printf("\n... and %d more databases\n", len(sorted)-10)
-			}
-		}
-
-		// Warning if insufficient space
-		if !estimate.HasSufficientSpace {
-			fmt.Println()
-			fmt.Println("⚠️  WARNING: Insufficient disk space!")
-			fmt.Printf("    Need %s more space to proceed safely.\n",
-				formatBytes(estimate.RequiredDiskSpace-estimate.AvailableDiskSpace))
-			fmt.Println()
-			fmt.Println("    Recommended actions:")
-			fmt.Println("    1. Free up disk space: dbbackup cleanup /backups --retention-days 7")
-			fmt.Println("    2. Use a different backup directory: --backup-dir /other/location")
-			fmt.Println("    3. Increase disk capacity")
-			fmt.Println("    4. Back up databases individually to spread across time/space")
-		}
-	}
-
-	return nil
-}
-
-// toJSON converts any struct to JSON string (simple helper)
-func toJSON(v interface{}) string {
-	b, _ := json.Marshal(v)
-	return string(b)
-}

cmd/forecast.go

@@ -1,443 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"math"
-	"os"
-	"strings"
-	"text/tabwriter"
-	"time"
-
-	"dbbackup/internal/catalog"
-
-	"github.com/spf13/cobra"
-)
-
-var forecastCmd = &cobra.Command{
-	Use:   "forecast [database]",
-	Short: "Predict future disk space requirements",
-	Long: `Analyze backup growth patterns and predict future disk space needs.
-
-This command helps with:
-  - Capacity planning (when will we run out of space?)
-  - Budget forecasting (how much storage to provision?)
-  - Growth trend analysis (is growth accelerating?)
-  - Alert thresholds (when to add capacity?)
-
-Uses historical backup data to calculate:
-  - Average daily growth rate
-  - Growth acceleration/deceleration
-  - Time until space limit reached
-  - Projected size at future dates
-
-Examples:
-  # Forecast for specific database
-  dbbackup forecast mydb
-
-  # Forecast all databases
-  dbbackup forecast --all
-
-  # Show projection for 90 days
-  dbbackup forecast mydb --days 90
-
-  # Set capacity limit (alert when approaching)
-  dbbackup forecast mydb --limit 100GB
-
-  # JSON output for automation
-  dbbackup forecast mydb --format json`,
-	Args: cobra.MaximumNArgs(1),
-	RunE: runForecast,
-}
-
-var (
-	forecastFormat    string
-	forecastAll       bool
-	forecastDays      int
-	forecastLimitSize string
-)
-
-type ForecastResult struct {
-	Database          string               `json:"database"`
-	CurrentSize       int64                `json:"current_size_bytes"`
-	TotalBackups      int                  `json:"total_backups"`
-	OldestBackup      time.Time            `json:"oldest_backup"`
-	NewestBackup      time.Time            `json:"newest_backup"`
-	ObservationPeriod time.Duration        `json:"observation_period_seconds"`
-	DailyGrowthRate   float64              `json:"daily_growth_bytes"`
-	DailyGrowthPct    float64              `json:"daily_growth_percent"`
-	Projections       []ForecastProjection `json:"projections"`
-	TimeToLimit       *time.Duration       `json:"time_to_limit_seconds,omitempty"`
-	SizeAtLimit       *time.Time           `json:"date_reaching_limit,omitempty"`
-	Confidence        string               `json:"confidence"` // "high", "medium", "low"
-}
-
-type ForecastProjection struct {
-	Days          int       `json:"days_from_now"`
-	Date          time.Time `json:"date"`
-	PredictedSize int64     `json:"predicted_size_bytes"`
-	Confidence    float64   `json:"confidence_percent"`
-}
-
-func init() {
-	rootCmd.AddCommand(forecastCmd)
-
-	forecastCmd.Flags().StringVar(&forecastFormat, "format", "table", "Output format (table, json)")
-	forecastCmd.Flags().BoolVar(&forecastAll, "all", false, "Show forecast for all databases")
-	forecastCmd.Flags().IntVar(&forecastDays, "days", 90, "Days to project into future")
-	forecastCmd.Flags().StringVar(&forecastLimitSize, "limit", "", "Capacity limit (e.g., '100GB', '1TB')")
-}
-
-func runForecast(cmd *cobra.Command, args []string) error {
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	var forecasts []*ForecastResult
-
-	if forecastAll || len(args) == 0 {
-		// Get all databases
-		databases, err := cat.ListDatabases(ctx)
-		if err != nil {
-			return err
-		}
-
-		for _, db := range databases {
-			forecast, err := calculateForecast(ctx, cat, db)
-			if err != nil {
-				return err
-			}
-			if forecast != nil {
-				forecasts = append(forecasts, forecast)
-			}
-		}
-	} else {
-		database := args[0]
-		forecast, err := calculateForecast(ctx, cat, database)
-		if err != nil {
-			return err
-		}
-		if forecast != nil {
-			forecasts = append(forecasts, forecast)
-		}
-	}
-
-	if len(forecasts) == 0 {
-		fmt.Println("No forecast data available.")
-		fmt.Println("\nRun 'dbbackup catalog sync <directory>' to import backups.")
-		return nil
-	}
-
-	// Parse limit if provided
-	var limitBytes int64
-	if forecastLimitSize != "" {
-		limitBytes, err = parseSize(forecastLimitSize)
-		if err != nil {
-			return fmt.Errorf("invalid limit size: %w", err)
-		}
-	}
-
-	// Output results
-	if forecastFormat == "json" {
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(forecasts)
-	}
-
-	// Table output
-	for i, forecast := range forecasts {
-		if i > 0 {
-			fmt.Println()
-		}
-		printForecast(forecast, limitBytes)
-	}
-
-	return nil
-}
-
-func calculateForecast(ctx context.Context, cat *catalog.SQLiteCatalog, database string) (*ForecastResult, error) {
-	// Get all backups for this database
-	query := &catalog.SearchQuery{
-		Database:  database,
-		Limit:     1000,
-		OrderBy:   "created_at",
-		OrderDesc: false,
-	}
-
-	entries, err := cat.Search(ctx, query)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(entries) < 2 {
-		return nil, nil // Need at least 2 backups for growth rate
-	}
-
-	// Calculate metrics
-	var totalSize int64
-	oldest := entries[0].CreatedAt
-	newest := entries[len(entries)-1].CreatedAt
-
-	for _, entry := range entries {
-		totalSize += entry.SizeBytes
-	}
-
-	// Calculate observation period
-	observationPeriod := newest.Sub(oldest)
-	if observationPeriod == 0 {
-		return nil, nil
-	}
-
-	// Calculate daily growth rate
-	firstSize := entries[0].SizeBytes
-	lastSize := entries[len(entries)-1].SizeBytes
-	sizeDelta := float64(lastSize - firstSize)
-
-	daysObserved := observationPeriod.Hours() / 24
-	dailyGrowthRate := sizeDelta / daysObserved
-
-	// Calculate daily growth percentage
-	var dailyGrowthPct float64
-	if firstSize > 0 {
-		dailyGrowthPct = (dailyGrowthRate / float64(firstSize)) * 100
-	}
-
-	// Determine confidence based on sample size and consistency
-	confidence := determineConfidence(entries, dailyGrowthRate)
-
-	// Generate projections
-	projections := make([]ForecastProjection, 0)
-	projectionDates := []int{7, 30, 60, 90, 180, 365}
-
-	if forecastDays > 0 {
-		// Use user-specified days
-		projectionDates = []int{forecastDays}
-		if forecastDays > 30 {
-			projectionDates = []int{7, 30, forecastDays}
-		}
-	}
-
-	for _, days := range projectionDates {
-		if days > 365 && forecastDays == 90 {
-			continue // Skip longer projections unless explicitly requested
-		}
-
-		predictedSize := lastSize + int64(dailyGrowthRate*float64(days))
-		if predictedSize < 0 {
-			predictedSize = 0
-		}
-
-		// Confidence decreases with time
-		confidencePct := calculateConfidence(days, confidence)
-
-		projections = append(projections, ForecastProjection{
-			Days:          days,
-			Date:          newest.Add(time.Duration(days) * 24 * time.Hour),
-			PredictedSize: predictedSize,
-			Confidence:    confidencePct,
-		})
-	}
-
-	result := &ForecastResult{
-		Database:          database,
-		CurrentSize:       lastSize,
-		TotalBackups:      len(entries),
-		OldestBackup:      oldest,
-		NewestBackup:      newest,
-		ObservationPeriod: observationPeriod,
-		DailyGrowthRate:   dailyGrowthRate,
-		DailyGrowthPct:    dailyGrowthPct,
-		Projections:       projections,
-		Confidence:        confidence,
-	}
-
-	return result, nil
-}
-
-func determineConfidence(entries []*catalog.Entry, avgGrowth float64) string {
-	if len(entries) < 5 {
-		return "low"
-	}
-	if len(entries) < 15 {
-		return "medium"
-	}
-
-	// Calculate variance in growth rates
-	var variance float64
-	for i := 1; i < len(entries); i++ {
-		timeDiff := entries[i].CreatedAt.Sub(entries[i-1].CreatedAt).Hours() / 24
-		if timeDiff == 0 {
-			continue
-		}
-		sizeDiff := float64(entries[i].SizeBytes - entries[i-1].SizeBytes)
-		growthRate := sizeDiff / timeDiff
-		variance += math.Pow(growthRate-avgGrowth, 2)
-	}
-	variance /= float64(len(entries) - 1)
-	stdDev := math.Sqrt(variance)
-
-	// If standard deviation is more than 50% of average growth, confidence is low
-	if stdDev > math.Abs(avgGrowth)*0.5 {
-		return "medium"
-	}
-
-	return "high"
-}
-
-func calculateConfidence(daysAhead int, baseConfidence string) float64 {
-	var base float64
-	switch baseConfidence {
-	case "high":
-		base = 95.0
-	case "medium":
-		base = 75.0
-	case "low":
-		base = 50.0
-	}
-
-	// Decay confidence over time (10% per 30 days)
-	decay := float64(daysAhead) / 30.0 * 10.0
-	confidence := base - decay
-
-	if confidence < 30 {
-		confidence = 30
-	}
-	return confidence
-}
-
-func printForecast(f *ForecastResult, limitBytes int64) {
-	fmt.Printf("[FORECAST] %s\n", f.Database)
-	fmt.Println(strings.Repeat("=", 60))
-
-	fmt.Printf("\n[CURRENT STATE]\n")
-	fmt.Printf("  Size:         %s\n", catalog.FormatSize(f.CurrentSize))
-	fmt.Printf("  Backups:      %d backups\n", f.TotalBackups)
-	fmt.Printf("  Observed:     %s (%.0f days)\n",
-		formatForecastDuration(f.ObservationPeriod),
-		f.ObservationPeriod.Hours()/24)
-
-	fmt.Printf("\n[GROWTH RATE]\n")
-	if f.DailyGrowthRate > 0 {
-		fmt.Printf("  Daily:        +%s/day (%.2f%%/day)\n",
-			catalog.FormatSize(int64(f.DailyGrowthRate)), f.DailyGrowthPct)
-		fmt.Printf("  Weekly:       +%s/week\n", catalog.FormatSize(int64(f.DailyGrowthRate*7)))
-		fmt.Printf("  Monthly:      +%s/month\n", catalog.FormatSize(int64(f.DailyGrowthRate*30)))
-		fmt.Printf("  Annual:       +%s/year\n", catalog.FormatSize(int64(f.DailyGrowthRate*365)))
-	} else if f.DailyGrowthRate < 0 {
-		fmt.Printf("  Daily:        %s/day (shrinking)\n", catalog.FormatSize(int64(f.DailyGrowthRate)))
-	} else {
-		fmt.Printf("  Daily:        No growth detected\n")
-	}
-	fmt.Printf("  Confidence:   %s (%d samples)\n", f.Confidence, f.TotalBackups)
-
-	if len(f.Projections) > 0 {
-		fmt.Printf("\n[PROJECTIONS]\n")
-		w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-		fmt.Fprintf(w, "  Days\tDate\tPredicted Size\tConfidence\n")
-		fmt.Fprintf(w, "  ----\t----\t--------------\t----------\n")
-
-		for _, proj := range f.Projections {
-			fmt.Fprintf(w, "  %d\t%s\t%s\t%.0f%%\n",
-				proj.Days,
-				proj.Date.Format("2006-01-02"),
-				catalog.FormatSize(proj.PredictedSize),
-				proj.Confidence)
-		}
-		w.Flush()
-	}
-
-	// Check against limit
-	if limitBytes > 0 {
-		fmt.Printf("\n[CAPACITY LIMIT]\n")
-		fmt.Printf("  Limit:        %s\n", catalog.FormatSize(limitBytes))
-
-		currentPct := float64(f.CurrentSize) / float64(limitBytes) * 100
-		fmt.Printf("  Current:      %.1f%% used\n", currentPct)
-
-		if f.CurrentSize >= limitBytes {
-			fmt.Printf("  Status:       [WARN] LIMIT EXCEEDED\n")
-		} else if currentPct >= 80 {
-			fmt.Printf("  Status:       [WARN] Approaching limit\n")
-		} else {
-			fmt.Printf("  Status:       [OK] Within limit\n")
-		}
-
-		// Calculate when we'll hit the limit
-		if f.DailyGrowthRate > 0 {
-			remaining := limitBytes - f.CurrentSize
-			daysToLimit := float64(remaining) / f.DailyGrowthRate
-
-			if daysToLimit > 0 && daysToLimit < 1000 {
-				dateAtLimit := f.NewestBackup.Add(time.Duration(daysToLimit*24) * time.Hour)
-				fmt.Printf("  Estimated:    Limit reached in %.0f days (%s)\n",
-					daysToLimit, dateAtLimit.Format("2006-01-02"))
-
-				if daysToLimit < 30 {
-					fmt.Printf("  Alert:        [CRITICAL] Less than 30 days remaining!\n")
-				} else if daysToLimit < 90 {
-					fmt.Printf("  Alert:        [WARN] Less than 90 days remaining\n")
-				}
-			}
-		}
-	}
-
-	fmt.Println()
-}
-
-func formatForecastDuration(d time.Duration) string {
-	hours := d.Hours()
-	if hours < 24 {
-		return fmt.Sprintf("%.1f hours", hours)
-	}
-	days := hours / 24
-	if days < 7 {
-		return fmt.Sprintf("%.1f days", days)
-	}
-	weeks := days / 7
-	if weeks < 4 {
-		return fmt.Sprintf("%.1f weeks", weeks)
-	}
-	months := days / 30
-	if months < 12 {
-		return fmt.Sprintf("%.1f months", months)
-	}
-	years := days / 365
-	return fmt.Sprintf("%.1f years", years)
-}
-
-func parseSize(s string) (int64, error) {
-	// Simple size parser (supports KB, MB, GB, TB)
-	s = strings.ToUpper(strings.TrimSpace(s))
-
-	var multiplier int64 = 1
-	var numStr string
-
-	if strings.HasSuffix(s, "TB") {
-		multiplier = 1024 * 1024 * 1024 * 1024
-		numStr = strings.TrimSuffix(s, "TB")
-	} else if strings.HasSuffix(s, "GB") {
-		multiplier = 1024 * 1024 * 1024
-		numStr = strings.TrimSuffix(s, "GB")
-	} else if strings.HasSuffix(s, "MB") {
-		multiplier = 1024 * 1024
-		numStr = strings.TrimSuffix(s, "MB")
-	} else if strings.HasSuffix(s, "KB") {
-		multiplier = 1024
-		numStr = strings.TrimSuffix(s, "KB")
-	} else {
-		numStr = s
-	}
-
-	var num float64
-	_, err := fmt.Sscanf(numStr, "%f", &num)
-	if err != nil {
-		return 0, fmt.Errorf("invalid size format: %s", s)
-	}
-
-	return int64(num * float64(multiplier)), nil
-}

cmd/health.go

@@ -1,699 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"dbbackup/internal/catalog"
-	"dbbackup/internal/database"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	healthFormat   string
-	healthVerbose  bool
-	healthInterval string
-	healthSkipDB   bool
-)
-
-// HealthStatus represents overall health
-type HealthStatus string
-
-const (
-	StatusHealthy  HealthStatus = "healthy"
-	StatusWarning  HealthStatus = "warning"
-	StatusCritical HealthStatus = "critical"
-)
-
-// HealthReport contains the complete health check results
-type HealthReport struct {
-	Status         HealthStatus          `json:"status"`
-	Timestamp      time.Time             `json:"timestamp"`
-	Summary        string                `json:"summary"`
-	Checks         []HealthCheck         `json:"checks"`
-	Recommendations []string             `json:"recommendations,omitempty"`
-}
-
-// HealthCheck represents a single health check
-type HealthCheck struct {
-	Name        string       `json:"name"`
-	Status      HealthStatus `json:"status"`
-	Message     string       `json:"message"`
-	Details     string       `json:"details,omitempty"`
-}
-
-// healthCmd is the health check command
-var healthCmd = &cobra.Command{
-	Use:   "health",
-	Short: "Check backup system health",
-	Long: `Comprehensive health check for your backup infrastructure.
-
-Checks:
-  - Database connectivity (can we reach the database?)
-  - Catalog integrity (is the backup database healthy?)
-  - Backup freshness (are backups up to date?)
-  - Gap detection (any missed scheduled backups?)
-  - Verification status (are backups verified?)
-  - File integrity (do backup files exist and match metadata?)
-  - Disk space (sufficient space for operations?)
-  - Configuration (valid settings?)
-
-Exit codes for automation:
-  0 = healthy (all checks passed)
-  1 = warning (some checks need attention)
-  2 = critical (immediate action required)
-
-Examples:
-  # Quick health check
-  dbbackup health
-
-  # Detailed output
-  dbbackup health --verbose
-
-  # JSON for monitoring integration
-  dbbackup health --format json
-
-  # Custom backup interval for gap detection
-  dbbackup health --interval 12h
-
-  # Skip database connectivity (offline check)
-  dbbackup health --skip-db`,
-	RunE: runHealthCheck,
-}
-
-func init() {
-	rootCmd.AddCommand(healthCmd)
-
-	healthCmd.Flags().StringVar(&healthFormat, "format", "table", "Output format (table, json)")
-	healthCmd.Flags().BoolVarP(&healthVerbose, "verbose", "v", false, "Show detailed output")
-	healthCmd.Flags().StringVar(&healthInterval, "interval", "24h", "Expected backup interval for gap detection")
-	healthCmd.Flags().BoolVar(&healthSkipDB, "skip-db", false, "Skip database connectivity check")
-}
-
-func runHealthCheck(cmd *cobra.Command, args []string) error {
-	report := &HealthReport{
-		Status:    StatusHealthy,
-		Timestamp: time.Now(),
-		Checks:    []HealthCheck{},
-	}
-
-	ctx := context.Background()
-
-	// Parse interval for gap detection
-	interval, err := time.ParseDuration(healthInterval)
-	if err != nil {
-		interval = 24 * time.Hour
-	}
-
-	// 1. Configuration check
-	report.addCheck(checkConfiguration())
-
-	// 2. Database connectivity (unless skipped)
-	if !healthSkipDB {
-		report.addCheck(checkDatabaseConnectivity(ctx))
-	}
-
-	// 3. Backup directory check
-	report.addCheck(checkBackupDir())
-
-	// 4. Catalog integrity check
-	catalogCheck, cat := checkCatalogIntegrity(ctx)
-	report.addCheck(catalogCheck)
-
-	if cat != nil {
-		defer cat.Close()
-
-		// 5. Backup freshness check
-		report.addCheck(checkBackupFreshness(ctx, cat, interval))
-
-		// 6. Gap detection
-		report.addCheck(checkBackupGaps(ctx, cat, interval))
-
-		// 7. Verification status
-		report.addCheck(checkVerificationStatus(ctx, cat))
-
-		// 8. File integrity (sampling)
-		report.addCheck(checkFileIntegrity(ctx, cat))
-
-		// 9. Orphaned entries
-		report.addCheck(checkOrphanedEntries(ctx, cat))
-	}
-
-	// 10. Disk space
-	report.addCheck(checkDiskSpace())
-
-	// Calculate overall status
-	report.calculateOverallStatus()
-
-	// Generate recommendations
-	report.generateRecommendations()
-
-	// Output
-	if healthFormat == "json" {
-		return outputHealthJSON(report)
-	}
-
-	outputHealthTable(report)
-
-	// Exit code based on status
-	switch report.Status {
-	case StatusWarning:
-		os.Exit(1)
-	case StatusCritical:
-		os.Exit(2)
-	}
-
-	return nil
-}
-
-func (r *HealthReport) addCheck(check HealthCheck) {
-	r.Checks = append(r.Checks, check)
-}
-
-func (r *HealthReport) calculateOverallStatus() {
-	criticalCount := 0
-	warningCount := 0
-	healthyCount := 0
-
-	for _, check := range r.Checks {
-		switch check.Status {
-		case StatusCritical:
-			criticalCount++
-		case StatusWarning:
-			warningCount++
-		case StatusHealthy:
-			healthyCount++
-		}
-	}
-
-	if criticalCount > 0 {
-		r.Status = StatusCritical
-		r.Summary = fmt.Sprintf("%d critical, %d warning, %d healthy", criticalCount, warningCount, healthyCount)
-	} else if warningCount > 0 {
-		r.Status = StatusWarning
-		r.Summary = fmt.Sprintf("%d warning, %d healthy", warningCount, healthyCount)
-	} else {
-		r.Status = StatusHealthy
-		r.Summary = fmt.Sprintf("All %d checks passed", healthyCount)
-	}
-}
-
-func (r *HealthReport) generateRecommendations() {
-	for _, check := range r.Checks {
-		switch {
-		case check.Name == "Backup Freshness" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Run a backup immediately: dbbackup backup cluster")
-		case check.Name == "Verification Status" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Verify recent backups: dbbackup verify-backup /path/to/backup")
-		case check.Name == "Disk Space" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Free up disk space or run cleanup: dbbackup cleanup")
-		case check.Name == "Backup Gaps" && check.Status == StatusCritical:
-			r.Recommendations = append(r.Recommendations, "Review backup schedule and cron configuration")
-		case check.Name == "Orphaned Entries" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Clean orphaned entries: dbbackup catalog cleanup --orphaned")
-		case check.Name == "Database Connectivity" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Check database connection settings in .dbbackup.conf")
-		}
-	}
-}
-
-// Individual health checks
-
-func checkConfiguration() HealthCheck {
-	check := HealthCheck{
-		Name:   "Configuration",
-		Status: StatusHealthy,
-	}
-
-	if err := cfg.Validate(); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Configuration invalid"
-		check.Details = err.Error()
-		return check
-	}
-
-	check.Message = "Configuration valid"
-	return check
-}
-
-func checkDatabaseConnectivity(ctx context.Context) HealthCheck {
-	check := HealthCheck{
-		Name:   "Database Connectivity",
-		Status: StatusHealthy,
-	}
-
-	db, err := database.New(cfg, log)
-	if err != nil {
-		check.Status = StatusCritical
-		check.Message = "Failed to create database instance"
-		check.Details = err.Error()
-		return check
-	}
-	defer db.Close()
-
-	if err := db.Connect(ctx); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Cannot connect to database"
-		check.Details = err.Error()
-		return check
-	}
-
-	version, _ := db.GetVersion(ctx)
-	check.Message = "Connected successfully"
-	check.Details = version
-
-	return check
-}
-
-func checkBackupDir() HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Directory",
-		Status: StatusHealthy,
-	}
-
-	info, err := os.Stat(cfg.BackupDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			check.Status = StatusWarning
-			check.Message = "Backup directory does not exist"
-			check.Details = cfg.BackupDir
-		} else {
-			check.Status = StatusCritical
-			check.Message = "Cannot access backup directory"
-			check.Details = err.Error()
-		}
-		return check
-	}
-
-	if !info.IsDir() {
-		check.Status = StatusCritical
-		check.Message = "Backup path is not a directory"
-		check.Details = cfg.BackupDir
-		return check
-	}
-
-	// Check writability
-	testFile := filepath.Join(cfg.BackupDir, ".health_check_test")
-	if err := os.WriteFile(testFile, []byte("test"), 0644); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Backup directory is not writable"
-		check.Details = err.Error()
-		return check
-	}
-	os.Remove(testFile)
-
-	check.Message = "Backup directory accessible"
-	check.Details = cfg.BackupDir
-
-	return check
-}
-
-func checkCatalogIntegrity(ctx context.Context) (HealthCheck, *catalog.SQLiteCatalog) {
-	check := HealthCheck{
-		Name:   "Catalog Integrity",
-		Status: StatusHealthy,
-	}
-
-	cat, err := openCatalog()
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Catalog not available"
-		check.Details = err.Error()
-		return check, nil
-	}
-
-	// Try a simple query to verify integrity
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusCritical
-		check.Message = "Catalog corrupted or inaccessible"
-		check.Details = err.Error()
-		cat.Close()
-		return check, nil
-	}
-
-	check.Message = fmt.Sprintf("Catalog healthy (%d backups tracked)", stats.TotalBackups)
-	check.Details = fmt.Sprintf("Size: %s", stats.TotalSizeHuman)
-
-	return check, cat
-}
-
-func checkBackupFreshness(ctx context.Context, cat *catalog.SQLiteCatalog, interval time.Duration) HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Freshness",
-		Status: StatusHealthy,
-	}
-
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Cannot determine backup freshness"
-		check.Details = err.Error()
-		return check
-	}
-
-	if stats.NewestBackup == nil {
-		check.Status = StatusCritical
-		check.Message = "No backups found in catalog"
-		return check
-	}
-
-	age := time.Since(*stats.NewestBackup)
-
-	if age > interval*3 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("Last backup is %s old (critical)", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	} else if age > interval {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("Last backup is %s old", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	} else {
-		check.Message = fmt.Sprintf("Last backup %s ago", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	}
-
-	return check
-}
-
-func checkBackupGaps(ctx context.Context, cat *catalog.SQLiteCatalog, interval time.Duration) HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Gaps",
-		Status: StatusHealthy,
-	}
-
-	config := &catalog.GapDetectionConfig{
-		ExpectedInterval: interval,
-		Tolerance:        interval / 4,
-		RPOThreshold:     interval * 2,
-	}
-
-	allGaps, err := cat.DetectAllGaps(ctx, config)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Gap detection failed"
-		check.Details = err.Error()
-		return check
-	}
-
-	totalGaps := 0
-	criticalGaps := 0
-	for _, gaps := range allGaps {
-		totalGaps += len(gaps)
-		for _, gap := range gaps {
-			if gap.Severity == catalog.SeverityCritical {
-				criticalGaps++
-			}
-		}
-	}
-
-	if criticalGaps > 0 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("%d critical gaps detected", criticalGaps)
-		check.Details = fmt.Sprintf("%d total gaps across %d databases", totalGaps, len(allGaps))
-	} else if totalGaps > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d gaps detected", totalGaps)
-		check.Details = fmt.Sprintf("Across %d databases", len(allGaps))
-	} else {
-		check.Message = "No backup gaps detected"
-	}
-
-	return check
-}
-
-func checkVerificationStatus(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "Verification Status",
-		Status: StatusHealthy,
-	}
-
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Cannot check verification status"
-		return check
-	}
-
-	if stats.TotalBackups == 0 {
-		check.Message = "No backups to verify"
-		return check
-	}
-
-	verifiedPct := float64(stats.VerifiedCount) / float64(stats.TotalBackups) * 100
-
-	if verifiedPct < 25 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("Only %.0f%% of backups verified", verifiedPct)
-		check.Details = fmt.Sprintf("%d/%d verified", stats.VerifiedCount, stats.TotalBackups)
-	} else {
-		check.Message = fmt.Sprintf("%.0f%% of backups verified", verifiedPct)
-		check.Details = fmt.Sprintf("%d/%d verified", stats.VerifiedCount, stats.TotalBackups)
-	}
-
-	// Check drill testing status too
-	if stats.DrillTestedCount > 0 {
-		check.Details += fmt.Sprintf(", %d drill tested", stats.DrillTestedCount)
-	}
-
-	return check
-}
-
-func checkFileIntegrity(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "File Integrity",
-		Status: StatusHealthy,
-	}
-
-	// Sample recent backups for file existence
-	entries, err := cat.Search(ctx, &catalog.SearchQuery{
-		Limit:     10,
-		OrderBy:   "created_at",
-		OrderDesc: true,
-	})
-	if err != nil || len(entries) == 0 {
-		check.Message = "No backups to check"
-		return check
-	}
-
-	missingCount := 0
-	checksumMismatch := 0
-
-	for _, entry := range entries {
-		// Skip cloud backups
-		if entry.CloudLocation != "" {
-			continue
-		}
-
-		// Check file exists
-		info, err := os.Stat(entry.BackupPath)
-		if err != nil {
-			missingCount++
-			continue
-		}
-
-		// Quick size check
-		if info.Size() != entry.SizeBytes {
-			checksumMismatch++
-		}
-	}
-
-	totalChecked := len(entries)
-
-	if missingCount > 0 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("%d/%d backup files missing", missingCount, totalChecked)
-	} else if checksumMismatch > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d/%d backups have size mismatch", checksumMismatch, totalChecked)
-	} else {
-		check.Message = fmt.Sprintf("Sampled %d recent backups - all present", totalChecked)
-	}
-
-	return check
-}
-
-func checkOrphanedEntries(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "Orphaned Entries",
-		Status: StatusHealthy,
-	}
-
-	// Check for catalog entries pointing to missing files
-	entries, err := cat.Search(ctx, &catalog.SearchQuery{
-		Limit:     50,
-		OrderBy:   "created_at",
-		OrderDesc: true,
-	})
-	if err != nil {
-		check.Message = "Cannot check for orphaned entries"
-		return check
-	}
-
-	orphanCount := 0
-	for _, entry := range entries {
-		if entry.CloudLocation != "" {
-			continue // Skip cloud backups
-		}
-		if _, err := os.Stat(entry.BackupPath); os.IsNotExist(err) {
-			orphanCount++
-		}
-	}
-
-	if orphanCount > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d orphaned catalog entries", orphanCount)
-		check.Details = "Files deleted but entries remain in catalog"
-	} else {
-		check.Message = "No orphaned entries detected"
-	}
-
-	return check
-}
-
-func checkDiskSpace() HealthCheck {
-	check := HealthCheck{
-		Name:   "Disk Space",
-		Status: StatusHealthy,
-	}
-
-	// Simple approach: check if we can write a test file
-	testPath := filepath.Join(cfg.BackupDir, ".space_check")
-	
-	// Create a 1MB test to ensure we have space
-	testData := make([]byte, 1024*1024)
-	if err := os.WriteFile(testPath, testData, 0644); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Insufficient disk space or write error"
-		check.Details = err.Error()
-		return check
-	}
-	os.Remove(testPath)
-
-	// Try to get actual free space (Linux-specific)
-	info, err := os.Stat(cfg.BackupDir)
-	if err == nil && info.IsDir() {
-		// Walk the backup directory to get size
-		var totalSize int64
-		filepath.Walk(cfg.BackupDir, func(path string, info os.FileInfo, err error) error {
-			if err == nil && !info.IsDir() {
-				totalSize += info.Size()
-			}
-			return nil
-		})
-
-		check.Message = "Disk space available"
-		check.Details = fmt.Sprintf("Backup directory using %s", formatBytesHealth(totalSize))
-	} else {
-		check.Message = "Disk space available"
-	}
-
-	return check
-}
-
-// Output functions
-
-func outputHealthTable(report *HealthReport) {
-	fmt.Println()
-	
-	statusIcon := "✅"
-	statusColor := "\033[32m" // green
-	if report.Status == StatusWarning {
-		statusIcon = "⚠️"
-		statusColor = "\033[33m" // yellow
-	} else if report.Status == StatusCritical {
-		statusIcon = "🚨"
-		statusColor = "\033[31m" // red
-	}
-
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-	fmt.Printf("  %s Backup Health Check\n", statusIcon)
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	fmt.Printf("Status: %s%s\033[0m\n", statusColor, strings.ToUpper(string(report.Status)))
-	fmt.Printf("Time:   %s\n", report.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Println()
-
-	fmt.Println("───────────────────────────────────────────────────────────────")
-	fmt.Println("CHECKS")
-	fmt.Println("───────────────────────────────────────────────────────────────")
-
-	for _, check := range report.Checks {
-		icon := "✓"
-		color := "\033[32m"
-		if check.Status == StatusWarning {
-			icon = "!"
-			color = "\033[33m"
-		} else if check.Status == StatusCritical {
-			icon = "✗"
-			color = "\033[31m"
-		}
-
-		fmt.Printf("%s[%s]\033[0m %-22s %s\n", color, icon, check.Name, check.Message)
-		
-		if healthVerbose && check.Details != "" {
-			fmt.Printf("      └─ %s\n", check.Details)
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("───────────────────────────────────────────────────────────────")
-	fmt.Printf("Summary: %s\n", report.Summary)
-	fmt.Println("───────────────────────────────────────────────────────────────")
-
-	if len(report.Recommendations) > 0 {
-		fmt.Println()
-		fmt.Println("RECOMMENDATIONS")
-		for _, rec := range report.Recommendations {
-			fmt.Printf("  → %s\n", rec)
-		}
-	}
-
-	fmt.Println()
-}
-
-func outputHealthJSON(report *HealthReport) error {
-	data, err := json.MarshalIndent(report, "", "  ")
-	if err != nil {
-		return err
-	}
-	fmt.Println(string(data))
-	return nil
-}
-
-// Helpers
-
-func formatDurationHealth(d time.Duration) string {
-	if d < time.Minute {
-		return fmt.Sprintf("%.0fs", d.Seconds())
-	}
-	if d < time.Hour {
-		return fmt.Sprintf("%.0fm", d.Minutes())
-	}
-	hours := int(d.Hours())
-	if hours < 24 {
-		return fmt.Sprintf("%dh", hours)
-	}
-	days := hours / 24
-	return fmt.Sprintf("%dd %dh", days, hours%24)
-}
-
-func formatBytesHealth(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}

cmd/integration_example.go

@@ -1,89 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"time"
-
-	"dbbackup/internal/engine/native"
-	"dbbackup/internal/logger"
-)
-
-// ExampleNativeEngineUsage demonstrates the complete native engine implementation
-func ExampleNativeEngineUsage() {
-	log := logger.New("INFO", "text")
-
-	// PostgreSQL Native Backup Example
-	fmt.Println("=== PostgreSQL Native Engine Example ===")
-	psqlConfig := &native.PostgreSQLNativeConfig{
-		Host:     "localhost",
-		Port:     5432,
-		User:     "postgres",
-		Password: "password",
-		Database: "mydb",
-
-		// Native engine specific options
-		SchemaOnly: false,
-		DataOnly:   false,
-		Format:     "sql",
-
-		// Filtering options
-		IncludeTable: []string{"users", "orders", "products"},
-		ExcludeTable: []string{"temp_*", "log_*"},
-
-		// Performance options
-		Parallel:    0,
-		Compression: 0,
-	}
-
-	// Create advanced PostgreSQL engine
-	psqlEngine, err := native.NewPostgreSQLAdvancedEngine(psqlConfig, log)
-	if err != nil {
-		fmt.Printf("Failed to create PostgreSQL engine: %v\n", err)
-		return
-	}
-	defer psqlEngine.Close()
-
-	// Advanced backup options
-	advancedOptions := &native.AdvancedBackupOptions{
-		Format:       native.FormatSQL,
-		Compression:  native.CompressionGzip,
-		ParallelJobs: psqlEngine.GetOptimalParallelJobs(),
-		BatchSize:    10000,
-
-		ConsistentSnapshot: true,
-		IncludeMetadata:    true,
-
-		PostgreSQL: &native.PostgreSQLAdvancedOptions{
-			IncludeBlobs:        true,
-			IncludeExtensions:   true,
-			QuoteAllIdentifiers: true,
-
-			CopyOptions: &native.PostgreSQLCopyOptions{
-				Format:     "csv",
-				Delimiter:  ",",
-				NullString: "\\N",
-				Header:     false,
-			},
-		},
-	}
-
-	// Perform advanced backup
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
-	defer cancel()
-
-	result, err := psqlEngine.AdvancedBackup(ctx, os.Stdout, advancedOptions)
-	if err != nil {
-		fmt.Printf("PostgreSQL backup failed: %v\n", err)
-	} else {
-		fmt.Printf("PostgreSQL backup completed: %+v\n", result)
-	}
-
-	fmt.Println("Native Engine Features Summary:")
-	fmt.Println("✅ Pure Go implementation - no external dependencies")
-	fmt.Println("✅ PostgreSQL native protocol support with pgx")
-	fmt.Println("✅ MySQL native protocol support with go-sql-driver")
-	fmt.Println("✅ Advanced data type handling and proper escaping")
-	fmt.Println("✅ Configurable batch processing for performance")
-}

cmd/man.go

@@ -1,181 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/cobra/doc"
-)
-
-var (
-	manOutputDir string
-)
-
-var manCmd = &cobra.Command{
-	Use:   "man",
-	Short: "Generate man pages for dbbackup",
-	Long: `Generate Unix manual (man) pages for all dbbackup commands.
-
-Man pages are generated in standard groff format and can be viewed
-with the 'man' command or installed system-wide.
-
-Installation:
-  # Generate pages
-  dbbackup man --output /tmp/man
-
-  # Install system-wide (requires root)
-  sudo cp /tmp/man/*.1 /usr/local/share/man/man1/
-  sudo mandb  # Update man database
-
-  # View pages
-  man dbbackup
-  man dbbackup-backup
-  man dbbackup-restore
-
-Examples:
-  # Generate to current directory
-  dbbackup man
-
-  # Generate to specific directory
-  dbbackup man --output ./docs/man
-
-  # Generate and install system-wide
-  dbbackup man --output /tmp/man && \
-    sudo cp /tmp/man/*.1 /usr/local/share/man/man1/ && \
-    sudo mandb`,
-	DisableFlagParsing: true, // Avoid shorthand conflicts during generation
-	RunE:               runGenerateMan,
-}
-
-func init() {
-	rootCmd.AddCommand(manCmd)
-	manCmd.Flags().StringVarP(&manOutputDir, "output", "o", "./man", "Output directory for man pages")
-
-	// Parse flags manually since DisableFlagParsing is enabled
-	manCmd.SetHelpFunc(func(cmd *cobra.Command, args []string) {
-		cmd.Parent().HelpFunc()(cmd, args)
-	})
-}
-
-func runGenerateMan(cmd *cobra.Command, args []string) error {
-	// Parse flags manually since DisableFlagParsing is enabled
-	outputDir := "./man"
-	for i := 0; i < len(args); i++ {
-		if args[i] == "--output" || args[i] == "-o" {
-			if i+1 < len(args) {
-				outputDir = args[i+1]
-				i++
-			}
-		}
-	}
-
-	// Create output directory
-	if err := os.MkdirAll(outputDir, 0755); err != nil {
-		return fmt.Errorf("failed to create output directory: %w", err)
-	}
-
-	// Generate man pages for root and all subcommands
-	header := &doc.GenManHeader{
-		Title:   "DBBACKUP",
-		Section: "1",
-		Source:  "dbbackup",
-		Manual:  "Database Backup Tool",
-	}
-
-	// Due to shorthand flag conflicts in some subcommands (-d for db-type vs database),
-	// we generate man pages command-by-command, catching any errors
-	root := cmd.Root()
-	generatedCount := 0
-	failedCount := 0
-
-	// Helper to generate man page for a single command
-	genManForCommand := func(c *cobra.Command) {
-		// Recover from panic due to flag conflicts
-		defer func() {
-			if r := recover(); r != nil {
-				failedCount++
-				// Silently skip commands with flag conflicts
-			}
-		}()
-
-		// Replace spaces with hyphens for filename
-		filename := filepath.Join(outputDir, filepath.Base(c.CommandPath())+".1")
-
-		f, err := os.Create(filename)
-		if err != nil {
-			failedCount++
-			return
-		}
-		defer f.Close()
-
-		if err := doc.GenMan(c, header, f); err != nil {
-			failedCount++
-			os.Remove(filename) // Clean up partial file
-		} else {
-			generatedCount++
-		}
-	}
-
-	// Generate for root command
-	genManForCommand(root)
-
-	// Walk through all commands
-	var walkCommands func(*cobra.Command)
-	walkCommands = func(c *cobra.Command) {
-		for _, sub := range c.Commands() {
-			// Skip hidden commands
-			if sub.Hidden {
-				continue
-			}
-
-			// Try to generate man page
-			genManForCommand(sub)
-
-			// Recurse into subcommands
-			walkCommands(sub)
-		}
-	}
-
-	walkCommands(root)
-
-	fmt.Printf("✅ Generated %d man pages in %s", generatedCount, outputDir)
-	if failedCount > 0 {
-		fmt.Printf(" (%d skipped due to flag conflicts)\n", failedCount)
-	} else {
-		fmt.Println()
-	}
-	fmt.Println()
-
-	fmt.Println("📖 Installation Instructions:")
-	fmt.Println()
-	fmt.Println("  1. Install system-wide (requires root):")
-	fmt.Printf("     sudo cp %s/*.1 /usr/local/share/man/man1/\n", outputDir)
-	fmt.Println("     sudo mandb")
-	fmt.Println()
-	fmt.Println("  2. Test locally (no installation):")
-	fmt.Printf("     man -l %s/dbbackup.1\n", outputDir)
-	fmt.Println()
-	fmt.Println("  3. View installed pages:")
-	fmt.Println("     man dbbackup")
-	fmt.Println("     man dbbackup-backup")
-	fmt.Println("     man dbbackup-restore")
-	fmt.Println()
-
-	// Show some example pages
-	files, err := filepath.Glob(filepath.Join(outputDir, "*.1"))
-	if err == nil && len(files) > 0 {
-		fmt.Println("📋 Generated Pages (sample):")
-		for i, file := range files {
-			if i >= 5 {
-				fmt.Printf("   ... and %d more\n", len(files)-5)
-				break
-			}
-			fmt.Printf("   - %s\n", filepath.Base(file))
-		}
-		fmt.Println()
-	}
-
-	return nil
-}

cmd/metrics.go

@@ -5,19 +5,17 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 
-	"dbbackup/internal/catalog"
 	"dbbackup/internal/prometheus"
 
 	"github.com/spf13/cobra"
 )
 
 var (
-	metricsServer string
-	metricsOutput string
-	metricsPort   int
+	metricsInstance string
+	metricsOutput   string
+	metricsPort     int
 )
 
 // metricsCmd represents the metrics command
@@ -47,7 +45,7 @@ Examples:
   dbbackup metrics export --output /var/lib/dbbackup/metrics/dbbackup.prom
 
   # Export for specific instance
-  dbbackup metrics export --server production --output /var/lib/dbbackup/metrics/production.prom
+  dbbackup metrics export --instance production --output /var/lib/dbbackup/metrics/production.prom
 
 After export, configure node_exporter with:
   --collector.textfile.directory=/var/lib/dbbackup/metrics/
@@ -86,56 +84,37 @@ Endpoints:
 	},
 }
 
-var metricsCatalogDB string
-
 func init() {
 	rootCmd.AddCommand(metricsCmd)
 	metricsCmd.AddCommand(metricsExportCmd)
 	metricsCmd.AddCommand(metricsServeCmd)
 
-	// Default catalog path (same as catalog command)
-	home, _ := os.UserHomeDir()
-	defaultCatalogPath := filepath.Join(home, ".dbbackup", "catalog.db")
-
 	// Export flags
-	metricsExportCmd.Flags().StringVar(&metricsServer, "server", "", "Server name for metrics labels (default: hostname)")
+	metricsExportCmd.Flags().StringVar(&metricsInstance, "instance", "default", "Instance name for metrics labels")
 	metricsExportCmd.Flags().StringVarP(&metricsOutput, "output", "o", "/var/lib/dbbackup/metrics/dbbackup.prom", "Output file path")
-	metricsExportCmd.Flags().StringVar(&metricsCatalogDB, "catalog-db", defaultCatalogPath, "Path to catalog SQLite database")
 
 	// Serve flags
-	metricsServeCmd.Flags().StringVar(&metricsServer, "server", "", "Server name for metrics labels (default: hostname)")
+	metricsServeCmd.Flags().StringVar(&metricsInstance, "instance", "default", "Instance name for metrics labels")
 	metricsServeCmd.Flags().IntVarP(&metricsPort, "port", "p", 9399, "HTTP server port")
-	metricsServeCmd.Flags().StringVar(&metricsCatalogDB, "catalog-db", defaultCatalogPath, "Path to catalog SQLite database")
 }
 
 func runMetricsExport(ctx context.Context) error {
-	// Auto-detect hostname if server not specified
-	server := metricsServer
-	if server == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			server = "unknown"
-		} else {
-			server = hostname
-		}
-	}
-
-	// Open catalog using specified path
-	cat, err := catalog.NewSQLiteCatalog(metricsCatalogDB)
+	// Open catalog
+	cat, err := openCatalog()
 	if err != nil {
 		return fmt.Errorf("failed to open catalog: %w", err)
 	}
 	defer cat.Close()
 
-	// Create metrics writer with version info
-	writer := prometheus.NewMetricsWriterWithVersion(log, cat, server, cfg.Version, cfg.GitCommit)
+	// Create metrics writer
+	writer := prometheus.NewMetricsWriter(log, cat, metricsInstance)
 
 	// Write textfile
 	if err := writer.WriteTextfile(metricsOutput); err != nil {
 		return fmt.Errorf("failed to write metrics: %w", err)
 	}
 
-	log.Info("Exported metrics to textfile", "path", metricsOutput, "server", server)
+	log.Info("Exported metrics to textfile", "path", metricsOutput, "instance", metricsInstance)
 	return nil
 }
 
@@ -144,26 +123,15 @@ func runMetricsServe(ctx context.Context) error {
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
 	defer cancel()
 
-	// Auto-detect hostname if server not specified
-	server := metricsServer
-	if server == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			server = "unknown"
-		} else {
-			server = hostname
-		}
-	}
-
-	// Open catalog using specified path
-	cat, err := catalog.NewSQLiteCatalog(metricsCatalogDB)
+	// Open catalog
+	cat, err := openCatalog()
 	if err != nil {
 		return fmt.Errorf("failed to open catalog: %w", err)
 	}
 	defer cat.Close()
 
-	// Create exporter with version info
-	exporter := prometheus.NewExporterWithVersion(log, cat, server, metricsPort, cfg.Version, cfg.GitCommit)
+	// Create exporter
+	exporter := prometheus.NewExporter(log, cat, metricsInstance, metricsPort)
 
 	// Run server (blocks until context is cancelled)
 	return exporter.Serve(ctx)

cmd/native_backup.go

@@ -1,277 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"dbbackup/internal/database"
-	"dbbackup/internal/engine/native"
-	"dbbackup/internal/notify"
-
-	"github.com/klauspost/pgzip"
-)
-
-// Native backup configuration flags
-var (
-	nativeAutoProfile  bool = true // Auto-detect optimal settings
-	nativeWorkers      int         // Manual worker count (0 = auto)
-	nativePoolSize     int         // Manual pool size (0 = auto)
-	nativeBufferSizeKB int         // Manual buffer size in KB (0 = auto)
-	nativeBatchSize    int         // Manual batch size (0 = auto)
-)
-
-// runNativeBackup executes backup using native Go engines
-func runNativeBackup(ctx context.Context, db database.Database, databaseName, backupType, baseBackup string, backupStartTime time.Time, user string) error {
-	var engineManager *native.EngineManager
-	var err error
-
-	// Build DSN for auto-profiling
-	dsn := buildNativeDSN(databaseName)
-
-	// Create engine manager with or without auto-profiling
-	if nativeAutoProfile && nativeWorkers == 0 && nativePoolSize == 0 {
-		// Use auto-profiling
-		log.Info("Auto-detecting optimal settings...")
-		engineManager, err = native.NewEngineManagerWithAutoConfig(ctx, cfg, log, dsn)
-		if err != nil {
-			log.Warn("Auto-profiling failed, using defaults", "error", err)
-			engineManager = native.NewEngineManager(cfg, log)
-		} else {
-			// Log the detected profile
-			if profile := engineManager.GetSystemProfile(); profile != nil {
-				log.Info("System profile detected",
-					"category", profile.Category.String(),
-					"workers", profile.RecommendedWorkers,
-					"pool_size", profile.RecommendedPoolSize,
-					"buffer_kb", profile.RecommendedBufferSize/1024)
-			}
-		}
-	} else {
-		// Use manual configuration
-		engineManager = native.NewEngineManager(cfg, log)
-
-		// Apply manual overrides if specified
-		if nativeWorkers > 0 || nativePoolSize > 0 || nativeBufferSizeKB > 0 {
-			adaptiveConfig := &native.AdaptiveConfig{
-				Mode:       native.ModeManual,
-				Workers:    nativeWorkers,
-				PoolSize:   nativePoolSize,
-				BufferSize: nativeBufferSizeKB * 1024,
-				BatchSize:  nativeBatchSize,
-			}
-			if adaptiveConfig.Workers == 0 {
-				adaptiveConfig.Workers = 4
-			}
-			if adaptiveConfig.PoolSize == 0 {
-				adaptiveConfig.PoolSize = adaptiveConfig.Workers + 2
-			}
-			if adaptiveConfig.BufferSize == 0 {
-				adaptiveConfig.BufferSize = 256 * 1024
-			}
-			if adaptiveConfig.BatchSize == 0 {
-				adaptiveConfig.BatchSize = 5000
-			}
-			engineManager.SetAdaptiveConfig(adaptiveConfig)
-			log.Info("Using manual configuration",
-				"workers", adaptiveConfig.Workers,
-				"pool_size", adaptiveConfig.PoolSize,
-				"buffer_kb", adaptiveConfig.BufferSize/1024)
-		}
-	}
-
-	if err := engineManager.InitializeEngines(ctx); err != nil {
-		return fmt.Errorf("failed to initialize native engines: %w", err)
-	}
-	defer engineManager.Close()
-
-	// Check if native engine is available for this database type
-	dbType := detectDatabaseTypeFromConfig()
-	if !engineManager.IsNativeEngineAvailable(dbType) {
-		return fmt.Errorf("native engine not available for database type: %s", dbType)
-	}
-
-	// Handle incremental backups - not yet supported by native engines
-	if backupType == "incremental" {
-		return fmt.Errorf("incremental backups not yet supported by native engines, use --fallback-tools")
-	}
-
-	// Generate output filename
-	timestamp := time.Now().Format("20060102_150405")
-	extension := ".sql"
-	// Note: compression is handled by the engine if configured
-	if cfg.CompressionLevel > 0 {
-		extension = ".sql.gz"
-	}
-
-	outputFile := filepath.Join(cfg.BackupDir, fmt.Sprintf("%s_%s_native%s",
-		databaseName, timestamp, extension))
-
-	// Ensure backup directory exists
-	if err := os.MkdirAll(cfg.BackupDir, 0750); err != nil {
-		return fmt.Errorf("failed to create backup directory: %w", err)
-	}
-
-	// Create output file
-	file, err := os.Create(outputFile)
-	if err != nil {
-		return fmt.Errorf("failed to create output file: %w", err)
-	}
-	defer file.Close()
-
-	// Wrap with compression if enabled (use pgzip for parallel compression)
-	var writer io.Writer = file
-	if cfg.CompressionLevel > 0 {
-		gzWriter, err := pgzip.NewWriterLevel(file, cfg.CompressionLevel)
-		if err != nil {
-			return fmt.Errorf("failed to create gzip writer: %w", err)
-		}
-		defer gzWriter.Close()
-		writer = gzWriter
-	}
-
-	log.Info("Starting native backup",
-		"database", databaseName,
-		"output", outputFile,
-		"engine", dbType)
-
-	// Perform backup using native engine
-	result, err := engineManager.BackupWithNativeEngine(ctx, writer)
-	if err != nil {
-		// Clean up failed backup file
-		os.Remove(outputFile)
-		auditLogger.LogBackupFailed(user, databaseName, err)
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Native backup failed").
-				WithDatabase(databaseName).
-				WithError(err))
-		}
-		return fmt.Errorf("native backup failed: %w", err)
-	}
-
-	backupDuration := time.Since(backupStartTime)
-
-	log.Info("Native backup completed successfully",
-		"database", databaseName,
-		"output", outputFile,
-		"size_bytes", result.BytesProcessed,
-		"objects", result.ObjectsProcessed,
-		"duration", backupDuration,
-		"engine", result.EngineUsed)
-
-	// Audit log: backup completed
-	auditLogger.LogBackupComplete(user, databaseName, cfg.BackupDir, result.BytesProcessed)
-
-	// Notify: backup completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupCompleted, notify.SeverityInfo, "Native backup completed").
-			WithDatabase(databaseName).
-			WithDetail("duration", backupDuration.String()).
-			WithDetail("size_bytes", fmt.Sprintf("%d", result.BytesProcessed)).
-			WithDetail("engine", result.EngineUsed).
-			WithDetail("output_file", outputFile))
-	}
-
-	return nil
-}
-
-// detectDatabaseTypeFromConfig determines database type from configuration
-func detectDatabaseTypeFromConfig() string {
-	if cfg.IsPostgreSQL() {
-		return "postgresql"
-	} else if cfg.IsMySQL() {
-		return "mysql"
-	}
-	return "unknown"
-}
-
-// buildNativeDSN builds a DSN from the global configuration for the appropriate database type
-func buildNativeDSN(databaseName string) string {
-	if cfg == nil {
-		return ""
-	}
-
-	host := cfg.Host
-	if host == "" {
-		host = "localhost"
-	}
-
-	dbName := databaseName
-	if dbName == "" {
-		dbName = cfg.Database
-	}
-
-	// Build MySQL DSN for MySQL/MariaDB
-	if cfg.IsMySQL() {
-		port := cfg.Port
-		if port == 0 {
-			port = 3306 // MySQL default port
-		}
-
-		user := cfg.User
-		if user == "" {
-			user = "root"
-		}
-
-		// MySQL DSN format: user:password@tcp(host:port)/dbname
-		dsn := user
-		if cfg.Password != "" {
-			dsn += ":" + cfg.Password
-		}
-		dsn += fmt.Sprintf("@tcp(%s:%d)/", host, port)
-		if dbName != "" {
-			dsn += dbName
-		}
-		return dsn
-	}
-
-	// Build PostgreSQL DSN (default)
-	port := cfg.Port
-	if port == 0 {
-		port = 5432 // PostgreSQL default port
-	}
-
-	user := cfg.User
-	if user == "" {
-		user = "postgres"
-	}
-
-	if dbName == "" {
-		dbName = "postgres"
-	}
-
-	// Check if host is a Unix socket path (starts with /)
-	isSocketPath := strings.HasPrefix(host, "/")
-
-	dsn := fmt.Sprintf("postgres://%s", user)
-	if cfg.Password != "" {
-		dsn += ":" + cfg.Password
-	}
-
-	if isSocketPath {
-		// Unix socket: use host parameter in query string
-		// pgx format: postgres://user@/dbname?host=/var/run/postgresql
-		dsn += fmt.Sprintf("@/%s", dbName)
-	} else {
-		// TCP connection: use host:port in authority
-		dsn += fmt.Sprintf("@%s:%d/%s", host, port, dbName)
-	}
-
-	sslMode := cfg.SSLMode
-	if sslMode == "" {
-		sslMode = "prefer"
-	}
-
-	if isSocketPath {
-		// For Unix sockets, add host parameter and disable SSL
-		dsn += fmt.Sprintf("?host=%s&sslmode=disable", host)
-	} else {
-		dsn += "?sslmode=" + sslMode
-	}
-
-	return dsn
-}

cmd/native_restore.go

@@ -1,147 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"time"
-
-	"dbbackup/internal/database"
-	"dbbackup/internal/engine/native"
-	"dbbackup/internal/notify"
-
-	"github.com/klauspost/pgzip"
-)
-
-// runNativeRestore executes restore using native Go engines
-func runNativeRestore(ctx context.Context, db database.Database, archivePath, targetDB string, cleanFirst, createIfMissing bool, startTime time.Time, user string) error {
-	var engineManager *native.EngineManager
-	var err error
-
-	// Build DSN for auto-profiling
-	dsn := buildNativeDSN(targetDB)
-
-	// Create engine manager with or without auto-profiling
-	if nativeAutoProfile && nativeWorkers == 0 && nativePoolSize == 0 {
-		// Use auto-profiling
-		log.Info("Auto-detecting optimal restore settings...")
-		engineManager, err = native.NewEngineManagerWithAutoConfig(ctx, cfg, log, dsn)
-		if err != nil {
-			log.Warn("Auto-profiling failed, using defaults", "error", err)
-			engineManager = native.NewEngineManager(cfg, log)
-		} else {
-			// Log the detected profile
-			if profile := engineManager.GetSystemProfile(); profile != nil {
-				log.Info("System profile detected for restore",
-					"category", profile.Category.String(),
-					"workers", profile.RecommendedWorkers,
-					"pool_size", profile.RecommendedPoolSize,
-					"buffer_kb", profile.RecommendedBufferSize/1024)
-			}
-		}
-	} else {
-		// Use manual configuration
-		engineManager = native.NewEngineManager(cfg, log)
-
-		// Apply manual overrides if specified
-		if nativeWorkers > 0 || nativePoolSize > 0 || nativeBufferSizeKB > 0 {
-			adaptiveConfig := &native.AdaptiveConfig{
-				Mode:       native.ModeManual,
-				Workers:    nativeWorkers,
-				PoolSize:   nativePoolSize,
-				BufferSize: nativeBufferSizeKB * 1024,
-				BatchSize:  nativeBatchSize,
-			}
-			if adaptiveConfig.Workers == 0 {
-				adaptiveConfig.Workers = 4
-			}
-			if adaptiveConfig.PoolSize == 0 {
-				adaptiveConfig.PoolSize = adaptiveConfig.Workers + 2
-			}
-			if adaptiveConfig.BufferSize == 0 {
-				adaptiveConfig.BufferSize = 256 * 1024
-			}
-			if adaptiveConfig.BatchSize == 0 {
-				adaptiveConfig.BatchSize = 5000
-			}
-			engineManager.SetAdaptiveConfig(adaptiveConfig)
-			log.Info("Using manual restore configuration",
-				"workers", adaptiveConfig.Workers,
-				"pool_size", adaptiveConfig.PoolSize,
-				"buffer_kb", adaptiveConfig.BufferSize/1024)
-		}
-	}
-
-	if err := engineManager.InitializeEngines(ctx); err != nil {
-		return fmt.Errorf("failed to initialize native engines: %w", err)
-	}
-	defer engineManager.Close()
-
-	// Check if native engine is available for this database type
-	dbType := detectDatabaseTypeFromConfig()
-	if !engineManager.IsNativeEngineAvailable(dbType) {
-		return fmt.Errorf("native restore engine not available for database type: %s", dbType)
-	}
-
-	// Open archive file
-	file, err := os.Open(archivePath)
-	if err != nil {
-		return fmt.Errorf("failed to open archive: %w", err)
-	}
-	defer file.Close()
-
-	// Detect if file is gzip compressed
-	var reader io.Reader = file
-	if isGzipFile(archivePath) {
-		gzReader, err := pgzip.NewReader(file)
-		if err != nil {
-			return fmt.Errorf("failed to create gzip reader: %w", err)
-		}
-		defer gzReader.Close()
-		reader = gzReader
-	}
-
-	log.Info("Starting native restore",
-		"archive", archivePath,
-		"database", targetDB,
-		"engine", dbType,
-		"clean_first", cleanFirst,
-		"create_if_missing", createIfMissing)
-
-	// Perform restore using native engine
-	if err := engineManager.RestoreWithNativeEngine(ctx, reader, targetDB); err != nil {
-		auditLogger.LogRestoreFailed(user, targetDB, err)
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventRestoreFailed, notify.SeverityError, "Native restore failed").
-				WithDatabase(targetDB).
-				WithError(err))
-		}
-		return fmt.Errorf("native restore failed: %w", err)
-	}
-
-	restoreDuration := time.Since(startTime)
-
-	log.Info("Native restore completed successfully",
-		"database", targetDB,
-		"duration", restoreDuration,
-		"engine", dbType)
-
-	// Audit log: restore completed
-	auditLogger.LogRestoreComplete(user, targetDB, restoreDuration)
-
-	// Notify: restore completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreCompleted, notify.SeverityInfo, "Native restore completed").
-			WithDatabase(targetDB).
-			WithDuration(restoreDuration).
-			WithDetail("engine", dbType))
-	}
-
-	return nil
-}
-
-// isGzipFile checks if file has gzip extension
-func isGzipFile(path string) bool {
-	return len(path) > 3 && path[len(path)-3:] == ".gz"
-}

cmd/notify.go

@@ -1,131 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"dbbackup/internal/notify"
-
-	"github.com/spf13/cobra"
-)
-
-var notifyCmd = &cobra.Command{
-	Use:   "notify",
-	Short: "Test notification integrations",
-	Long: `Test notification integrations (webhooks, email).
-
-This command sends test notifications to verify configuration and connectivity.
-Helps ensure notifications will work before critical events occur.
-
-Supports:
-  - Generic Webhooks (HTTP POST)
-  - Email (SMTP)
-
-Examples:
-  # Test all configured notifications
-  dbbackup notify test
-
-  # Test with custom message
-  dbbackup notify test --message "Hello from dbbackup"
-
-  # Test with verbose output
-  dbbackup notify test --verbose`,
-}
-
-var testNotifyCmd = &cobra.Command{
-	Use:   "test",
-	Short: "Send test notification",
-	Long:  `Send a test notification to verify configuration and connectivity.`,
-	RunE:  runNotifyTest,
-}
-
-var (
-	notifyMessage string
-	notifyVerbose bool
-)
-
-func init() {
-	rootCmd.AddCommand(notifyCmd)
-	notifyCmd.AddCommand(testNotifyCmd)
-
-	testNotifyCmd.Flags().StringVar(&notifyMessage, "message", "", "Custom test message")
-	testNotifyCmd.Flags().BoolVar(&notifyVerbose, "verbose", false, "Verbose output")
-}
-
-func runNotifyTest(cmd *cobra.Command, args []string) error {
-	// Load notification config from environment variables (same as root.go)
-	notifyCfg := notify.ConfigFromEnv()
-
-	// Check if any notification method is configured
-	if !notifyCfg.SMTPEnabled && !notifyCfg.WebhookEnabled {
-		fmt.Println("[WARN] No notification endpoints configured")
-		fmt.Println()
-		fmt.Println("Configure via environment variables:")
-		fmt.Println()
-		fmt.Println("  SMTP Email:")
-		fmt.Println("    NOTIFY_SMTP_HOST=smtp.example.com")
-		fmt.Println("    NOTIFY_SMTP_PORT=587")
-		fmt.Println("    NOTIFY_SMTP_FROM=backups@example.com")
-		fmt.Println("    NOTIFY_SMTP_TO=admin@example.com")
-		fmt.Println()
-		fmt.Println("  Webhook:")
-		fmt.Println("    NOTIFY_WEBHOOK_URL=https://your-webhook-url")
-		fmt.Println()
-		fmt.Println("  Optional:")
-		fmt.Println("    NOTIFY_SMTP_USER=username")
-		fmt.Println("    NOTIFY_SMTP_PASSWORD=password")
-		fmt.Println("    NOTIFY_SMTP_STARTTLS=true")
-		fmt.Println("    NOTIFY_WEBHOOK_SECRET=hmac-secret")
-		return nil
-	}
-
-	// Use custom message or default
-	message := notifyMessage
-	if message == "" {
-		message = fmt.Sprintf("Test notification from dbbackup at %s", time.Now().Format(time.RFC3339))
-	}
-
-	fmt.Println("[TEST] Testing notification configuration...")
-	fmt.Println()
-
-	// Show what will be tested
-	if notifyCfg.WebhookEnabled {
-		fmt.Printf("[INFO] Webhook configured: %s\n", notifyCfg.WebhookURL)
-	}
-	if notifyCfg.SMTPEnabled {
-		fmt.Printf("[INFO] SMTP configured: %s:%d\n", notifyCfg.SMTPHost, notifyCfg.SMTPPort)
-		fmt.Printf("       From: %s\n", notifyCfg.SMTPFrom)
-		if len(notifyCfg.SMTPTo) > 0 {
-			fmt.Printf("       To:   %v\n", notifyCfg.SMTPTo)
-		}
-	}
-	fmt.Println()
-
-	// Create manager
-	manager := notify.NewManager(notifyCfg)
-
-	// Create test event
-	event := notify.NewEvent("test", notify.SeverityInfo, message)
-	event.WithDetail("test", "true")
-	event.WithDetail("command", "dbbackup notify test")
-
-	if notifyVerbose {
-		fmt.Printf("[DEBUG] Sending event: %+v\n", event)
-	}
-
-	// Send notification
-	fmt.Println("[SEND] Sending test notification...")
-
-	ctx := context.Background()
-	if err := manager.NotifySync(ctx, event); err != nil {
-		fmt.Printf("[FAIL] Notification failed: %v\n", err)
-		return err
-	}
-
-	fmt.Println("[OK] Notification sent successfully")
-	fmt.Println()
-	fmt.Println("Check your notification endpoint to confirm delivery.")
-
-	return nil
-}

cmd/parallel_restore.go

@@ -1,428 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-
-	"github.com/spf13/cobra"
-)
-
-var parallelRestoreCmd = &cobra.Command{
-	Use:   "parallel-restore",
-	Short: "Configure and test parallel restore settings",
-	Long: `Configure parallel restore settings for faster database restoration.
-
-Parallel restore uses multiple threads to restore databases concurrently:
-  - Parallel jobs within single database (--jobs flag)
-  - Parallel database restoration for cluster backups
-  - CPU-aware thread allocation
-  - Memory-aware resource limits
-
-This significantly reduces restoration time for:
-  - Large databases with many tables
-  - Cluster backups with multiple databases
-  - Systems with multiple CPU cores
-
-Configuration:
-  - Set parallel jobs count (default: auto-detect CPU cores)
-  - Configure memory limits for large restores
-  - Tune for specific hardware profiles
-
-Examples:
-  # Show current parallel restore configuration
-  dbbackup parallel-restore status
-
-  # Test parallel restore performance
-  dbbackup parallel-restore benchmark --file backup.dump
-
-  # Show recommended settings for current system
-  dbbackup parallel-restore recommend
-
-  # Simulate parallel restore (dry-run)
-  dbbackup parallel-restore simulate --file backup.dump --jobs 8`,
-}
-
-var parallelRestoreStatusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "Show parallel restore configuration",
-	Long:  `Display current parallel restore configuration and system capabilities.`,
-	RunE:  runParallelRestoreStatus,
-}
-
-var parallelRestoreBenchmarkCmd = &cobra.Command{
-	Use:   "benchmark",
-	Short: "Benchmark parallel restore performance",
-	Long:  `Benchmark parallel restore with different thread counts to find optimal settings.`,
-	RunE:  runParallelRestoreBenchmark,
-}
-
-var parallelRestoreRecommendCmd = &cobra.Command{
-	Use:   "recommend",
-	Short: "Get recommended parallel restore settings",
-	Long:  `Analyze system resources and recommend optimal parallel restore settings.`,
-	RunE:  runParallelRestoreRecommend,
-}
-
-var parallelRestoreSimulateCmd = &cobra.Command{
-	Use:   "simulate",
-	Short: "Simulate parallel restore execution plan",
-	Long:  `Simulate parallel restore without actually restoring data to show execution plan.`,
-	RunE:  runParallelRestoreSimulate,
-}
-
-var (
-	parallelRestoreFile   string
-	parallelRestoreJobs   int
-	parallelRestoreFormat string
-)
-
-func init() {
-	rootCmd.AddCommand(parallelRestoreCmd)
-
-	parallelRestoreCmd.AddCommand(parallelRestoreStatusCmd)
-	parallelRestoreCmd.AddCommand(parallelRestoreBenchmarkCmd)
-	parallelRestoreCmd.AddCommand(parallelRestoreRecommendCmd)
-	parallelRestoreCmd.AddCommand(parallelRestoreSimulateCmd)
-
-	parallelRestoreStatusCmd.Flags().StringVar(&parallelRestoreFormat, "format", "text", "Output format (text, json)")
-	parallelRestoreBenchmarkCmd.Flags().StringVar(&parallelRestoreFile, "file", "", "Backup file to benchmark (required)")
-	parallelRestoreBenchmarkCmd.MarkFlagRequired("file")
-	parallelRestoreSimulateCmd.Flags().StringVar(&parallelRestoreFile, "file", "", "Backup file to simulate (required)")
-	parallelRestoreSimulateCmd.Flags().IntVar(&parallelRestoreJobs, "jobs", 0, "Number of parallel jobs (0=auto)")
-	parallelRestoreSimulateCmd.MarkFlagRequired("file")
-}
-
-func runParallelRestoreStatus(cmd *cobra.Command, args []string) error {
-	numCPU := runtime.NumCPU()
-	recommendedJobs := numCPU
-	if numCPU > 8 {
-		recommendedJobs = numCPU - 2 // Leave headroom
-	}
-
-	status := ParallelRestoreStatus{
-		SystemCPUs:        numCPU,
-		RecommendedJobs:   recommendedJobs,
-		MaxJobs:           numCPU * 2,
-		CurrentJobs:       cfg.Jobs,
-		MemoryGB:          getAvailableMemoryGB(),
-		ParallelSupported: true,
-	}
-
-	if parallelRestoreFormat == "json" {
-		data, _ := json.MarshalIndent(status, "", "  ")
-		fmt.Println(string(data))
-		return nil
-	}
-
-	fmt.Println("[PARALLEL RESTORE] System Capabilities")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Printf("CPU Cores:        %d\n", status.SystemCPUs)
-	fmt.Printf("Available Memory: %.1f GB\n", status.MemoryGB)
-	fmt.Println()
-
-	fmt.Println("[CONFIGURATION]")
-	fmt.Println("==========================================")
-	fmt.Printf("Current Jobs:     %d\n", status.CurrentJobs)
-	fmt.Printf("Recommended Jobs: %d\n", status.RecommendedJobs)
-	fmt.Printf("Maximum Jobs:     %d\n", status.MaxJobs)
-	fmt.Println()
-
-	fmt.Println("[PARALLEL RESTORE MODES]")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("1. Single Database Parallel Restore:")
-	fmt.Println("   Uses pg_restore -j flag or parallel mysql restore")
-	fmt.Println("   Restores tables concurrently within one database")
-	fmt.Println("   Example: dbbackup restore single db.dump --jobs 8 --confirm")
-	fmt.Println()
-	fmt.Println("2. Cluster Parallel Restore:")
-	fmt.Println("   Restores multiple databases concurrently")
-	fmt.Println("   Each database can use parallel jobs")
-	fmt.Println("   Example: dbbackup restore cluster backup.tar --jobs 4 --confirm")
-	fmt.Println()
-
-	fmt.Println("[PERFORMANCE TIPS]")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("• Start with recommended jobs count")
-	fmt.Println("• More jobs ≠ always faster (context switching overhead)")
-	fmt.Printf("• For this system: --jobs %d is optimal\n", status.RecommendedJobs)
-	fmt.Println("• Monitor system load during restore")
-	fmt.Println("• Use --profile aggressive for maximum speed")
-	fmt.Println("• SSD storage benefits more from parallelization")
-	fmt.Println()
-
-	return nil
-}
-
-func runParallelRestoreBenchmark(cmd *cobra.Command, args []string) error {
-	if _, err := os.Stat(parallelRestoreFile); err != nil {
-		return fmt.Errorf("backup file not found: %s", parallelRestoreFile)
-	}
-
-	fmt.Println("[PARALLEL RESTORE] Benchmark Mode")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Printf("Backup File: %s\n", parallelRestoreFile)
-	fmt.Println()
-
-	// Detect backup format
-	ext := filepath.Ext(parallelRestoreFile)
-	format := "unknown"
-	if ext == ".dump" || ext == ".pgdump" {
-		format = "PostgreSQL custom format"
-	} else if ext == ".sql" || ext == ".gz" && filepath.Ext(parallelRestoreFile[:len(parallelRestoreFile)-3]) == ".sql" {
-		format = "SQL format"
-	} else if ext == ".tar" || ext == ".tgz" {
-		format = "Cluster backup"
-	}
-
-	fmt.Printf("Detected Format: %s\n", format)
-	fmt.Println()
-
-	fmt.Println("[BENCHMARK STRATEGY]")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("Benchmarking would test restore with different job counts:")
-	fmt.Println()
-
-	numCPU := runtime.NumCPU()
-	testConfigs := []int{1, 2, 4}
-	if numCPU >= 8 {
-		testConfigs = append(testConfigs, 8)
-	}
-	if numCPU >= 16 {
-		testConfigs = append(testConfigs, 16)
-	}
-
-	for i, jobs := range testConfigs {
-		estimatedTime := estimateRestoreTime(parallelRestoreFile, jobs)
-		fmt.Printf("%d. Jobs=%d → Estimated: %s\n", i+1, jobs, estimatedTime)
-	}
-
-	fmt.Println()
-	fmt.Println("[NOTE]")
-	fmt.Println("==========================================")
-	fmt.Println("Actual benchmarking requires:")
-	fmt.Println("  - Test database or dry-run mode")
-	fmt.Println("  - Multiple restore attempts with different job counts")
-	fmt.Println("  - Measurement of wall clock time")
-	fmt.Println()
-	fmt.Println("For now, use 'dbbackup restore single --dry-run' to test without")
-	fmt.Println("actually restoring data.")
-	fmt.Println()
-
-	return nil
-}
-
-func runParallelRestoreRecommend(cmd *cobra.Command, args []string) error {
-	numCPU := runtime.NumCPU()
-	memoryGB := getAvailableMemoryGB()
-
-	fmt.Println("[PARALLEL RESTORE] Recommendations")
-	fmt.Println("==========================================")
-	fmt.Println()
-
-	fmt.Println("[SYSTEM ANALYSIS]")
-	fmt.Println("==========================================")
-	fmt.Printf("CPU Cores:        %d\n", numCPU)
-	fmt.Printf("Available Memory: %.1f GB\n", memoryGB)
-	fmt.Println()
-
-	// Calculate recommendations
-	var recommendedJobs int
-	var profile string
-
-	if memoryGB < 2 {
-		recommendedJobs = 1
-		profile = "conservative"
-	} else if memoryGB < 8 {
-		recommendedJobs = min(numCPU/2, 4)
-		profile = "conservative"
-	} else if memoryGB < 16 {
-		recommendedJobs = min(numCPU-1, 8)
-		profile = "balanced"
-	} else {
-		recommendedJobs = numCPU
-		if numCPU > 8 {
-			recommendedJobs = numCPU - 2
-		}
-		profile = "aggressive"
-	}
-
-	fmt.Println("[RECOMMENDATIONS]")
-	fmt.Println("==========================================")
-	fmt.Printf("Recommended Profile: %s\n", profile)
-	fmt.Printf("Recommended Jobs:    %d\n", recommendedJobs)
-	fmt.Println()
-
-	fmt.Println("[COMMAND EXAMPLES]")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("Single database restore (recommended):")
-	fmt.Printf("  dbbackup restore single db.dump --jobs %d --profile %s --confirm\n", recommendedJobs, profile)
-	fmt.Println()
-	fmt.Println("Cluster restore (recommended):")
-	fmt.Printf("  dbbackup restore cluster backup.tar --jobs %d --profile %s --confirm\n", recommendedJobs, profile)
-	fmt.Println()
-
-	if memoryGB < 4 {
-		fmt.Println("[⚠ LOW MEMORY WARNING]")
-		fmt.Println("==========================================")
-		fmt.Println("Your system has limited memory. Consider:")
-		fmt.Println("  - Using --low-memory flag")
-		fmt.Println("  - Restoring databases one at a time")
-		fmt.Println("  - Reducing --jobs count")
-		fmt.Println("  - Closing other applications")
-		fmt.Println()
-	}
-
-	if numCPU >= 16 {
-		fmt.Println("[💡 HIGH-PERFORMANCE TIPS]")
-		fmt.Println("==========================================")
-		fmt.Println("Your system has many cores. Optimize with:")
-		fmt.Println("  - Use --profile aggressive")
-		fmt.Printf("  - Try up to --jobs %d\n", numCPU)
-		fmt.Println("  - Monitor with 'dbbackup restore ... --verbose'")
-		fmt.Println("  - Use SSD storage for temp files")
-		fmt.Println()
-	}
-
-	return nil
-}
-
-func runParallelRestoreSimulate(cmd *cobra.Command, args []string) error {
-	if _, err := os.Stat(parallelRestoreFile); err != nil {
-		return fmt.Errorf("backup file not found: %s", parallelRestoreFile)
-	}
-
-	jobs := parallelRestoreJobs
-	if jobs == 0 {
-		jobs = runtime.NumCPU()
-		if jobs > 8 {
-			jobs = jobs - 2
-		}
-	}
-
-	fmt.Println("[PARALLEL RESTORE] Simulation")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Printf("Backup File:   %s\n", parallelRestoreFile)
-	fmt.Printf("Parallel Jobs: %d\n", jobs)
-	fmt.Println()
-
-	// Detect backup type
-	ext := filepath.Ext(parallelRestoreFile)
-	isCluster := ext == ".tar" || ext == ".tgz"
-
-	if isCluster {
-		fmt.Println("[CLUSTER RESTORE PLAN]")
-		fmt.Println("==========================================")
-		fmt.Println()
-		fmt.Println("Phase 1: Extract archive")
-		fmt.Println("  • Decompress backup archive")
-		fmt.Println("  • Extract globals.sql, schemas, and database dumps")
-		fmt.Println()
-		fmt.Println("Phase 2: Restore globals (sequential)")
-		fmt.Println("  • Restore roles and permissions")
-		fmt.Println("  • Restore tablespaces")
-		fmt.Println()
-		fmt.Println("Phase 3: Parallel database restore")
-		fmt.Printf("  • Restore databases with %d parallel jobs\n", jobs)
-		fmt.Println("  • Each database can use internal parallelization")
-		fmt.Println()
-		fmt.Println("Estimated databases: 3-10 (actual count varies)")
-		fmt.Println("Estimated speedup:   3-5x vs sequential")
-	} else {
-		fmt.Println("[SINGLE DATABASE RESTORE PLAN]")
-		fmt.Println("==========================================")
-		fmt.Println()
-		fmt.Println("Phase 1: Pre-restore checks")
-		fmt.Println("  • Verify backup file integrity")
-		fmt.Println("  • Check target database connection")
-		fmt.Println("  • Validate sufficient disk space")
-		fmt.Println()
-		fmt.Println("Phase 2: Schema preparation")
-		fmt.Println("  • Create database (if needed)")
-		fmt.Println("  • Drop existing objects (if --clean)")
-		fmt.Println()
-		fmt.Println("Phase 3: Parallel data restore")
-		fmt.Printf("  • Restore tables with %d parallel jobs\n", jobs)
-		fmt.Println("  • Each job processes different tables")
-		fmt.Println("  • Automatic load balancing")
-		fmt.Println()
-		fmt.Println("Phase 4: Post-restore")
-		fmt.Println("  • Rebuild indexes")
-		fmt.Println("  • Restore constraints")
-		fmt.Println("  • Update statistics")
-		fmt.Println()
-		fmt.Printf("Estimated speedup: %dx vs sequential restore\n", estimateSpeedup(jobs))
-	}
-
-	fmt.Println()
-	fmt.Println("[EXECUTION COMMAND]")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("To perform this restore:")
-	if isCluster {
-		fmt.Printf("  dbbackup restore cluster %s --jobs %d --confirm\n", parallelRestoreFile, jobs)
-	} else {
-		fmt.Printf("  dbbackup restore single %s --jobs %d --confirm\n", parallelRestoreFile, jobs)
-	}
-	fmt.Println()
-
-	return nil
-}
-
-type ParallelRestoreStatus struct {
-	SystemCPUs        int     `json:"system_cpus"`
-	RecommendedJobs   int     `json:"recommended_jobs"`
-	MaxJobs           int     `json:"max_jobs"`
-	CurrentJobs       int     `json:"current_jobs"`
-	MemoryGB          float64 `json:"memory_gb"`
-	ParallelSupported bool    `json:"parallel_supported"`
-}
-
-func getAvailableMemoryGB() float64 {
-	// Simple estimation - in production would query actual system memory
-	// For now, return a reasonable default
-	return 8.0
-}
-
-func estimateRestoreTime(file string, jobs int) string {
-	// Simplified estimation based on file size and jobs
-	info, err := os.Stat(file)
-	if err != nil {
-		return "unknown"
-	}
-
-	sizeGB := float64(info.Size()) / (1024 * 1024 * 1024)
-	baseTime := sizeGB * 120                       // ~2 minutes per GB baseline
-	parallelTime := baseTime / float64(jobs) * 0.7 // 70% efficiency
-
-	if parallelTime < 60 {
-		return fmt.Sprintf("%.0fs", parallelTime)
-	}
-	return fmt.Sprintf("%.1fm", parallelTime/60)
-}
-
-func estimateSpeedup(jobs int) int {
-	// Amdahl's law: assume 80% parallelizable
-	if jobs <= 1 {
-		return 1
-	}
-	// Simple linear speedup with diminishing returns
-	speedup := 1.0 + float64(jobs-1)*0.7
-	return int(speedup)
-}
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}

cmd/pitr.go

@@ -5,7 +5,7 @@ import (
 	"database/sql"
 	"fmt"
 	"os"
-	"strings"
+	"path/filepath"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -44,6 +44,7 @@ var (
 	mysqlArchiveInterval  string
 	mysqlRequireRowFormat bool
 	mysqlRequireGTID      bool
+	mysqlWatchMode        bool
 )
 
 // pitrCmd represents the pitr command group
@@ -506,24 +507,12 @@ func runPITRStatus(cmd *cobra.Command, args []string) error {
 
 	// Show WAL archive statistics if archive directory can be determined
 	if config.ArchiveCommand != "" {
-		archiveDir := extractArchiveDirFromCommand(config.ArchiveCommand)
-		if archiveDir != "" {
-			fmt.Println()
-			fmt.Println("WAL Archive Statistics:")
-			fmt.Println("======================================================")
-			stats, err := wal.GetArchiveStats(archiveDir)
-			if err != nil {
-				fmt.Printf("  ⚠ Could not read archive: %v\n", err)
-				fmt.Printf("  (Archive directory: %s)\n", archiveDir)
-			} else {
-				fmt.Print(wal.FormatArchiveStats(stats))
-			}
-		} else {
-			fmt.Println()
-			fmt.Println("WAL Archive Statistics:")
-			fmt.Println("======================================================")
-			fmt.Println("  (Use 'dbbackup wal list --archive-dir <dir>' to view archives)")
-		}
+		// Extract archive dir from command (simple parsing)
+		fmt.Println()
+		fmt.Println("WAL Archive Statistics:")
+		fmt.Println("======================================================")
+		// TODO: Parse archive dir and show stats
+		fmt.Println("  (Use 'dbbackup wal list --archive-dir <dir>' to view archives)")
 	}
 
 	return nil
@@ -1323,35 +1312,13 @@ func runMySQLPITREnable(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-// extractArchiveDirFromCommand attempts to extract the archive directory
-// from a PostgreSQL archive_command string
-// Example: "dbbackup wal archive %p %f --archive-dir=/mnt/wal" → "/mnt/wal"
-func extractArchiveDirFromCommand(command string) string {
-	// Look for common patterns:
-	// 1. --archive-dir=/path
-	// 2. --archive-dir /path
-	// 3. Plain path argument
-
-	parts := strings.Fields(command)
-	for i, part := range parts {
-		// Pattern: --archive-dir=/path
-		if strings.HasPrefix(part, "--archive-dir=") {
-			return strings.TrimPrefix(part, "--archive-dir=")
-		}
-		// Pattern: --archive-dir /path
-		if part == "--archive-dir" && i+1 < len(parts) {
-			return parts[i+1]
-		}
+// getMySQLBinlogDir attempts to determine the binlog directory from MySQL
+func getMySQLBinlogDir(ctx context.Context, db *sql.DB) (string, error) {
+	var logBinBasename string
+	err := db.QueryRowContext(ctx, "SELECT @@log_bin_basename").Scan(&logBinBasename)
+	if err != nil {
+		return "", err
 	}
 
-	// If command contains dbbackup, the last argument might be the archive dir
-	if strings.Contains(command, "dbbackup") && len(parts) > 2 {
-		lastArg := parts[len(parts)-1]
-		// Check if it looks like a path
-		if strings.HasPrefix(lastArg, "/") || strings.HasPrefix(lastArg, "./") {
-			return lastArg
-		}
-	}
-
-	return ""
+	return filepath.Dir(logBinBasename), nil
 }

cmd/placeholder.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
@@ -14,7 +15,6 @@ import (
 	"dbbackup/internal/logger"
 	"dbbackup/internal/tui"
 
-	"github.com/klauspost/pgzip"
 	"github.com/spf13/cobra"
 )
 
@@ -66,22 +66,6 @@ TUI Automation Flags (for testing and CI/CD):
 		cfg.TUIVerbose, _ = cmd.Flags().GetBool("verbose-tui")
 		cfg.TUILogFile, _ = cmd.Flags().GetString("tui-log-file")
 
-		// FIXED: Only set default profile if user hasn't configured one
-		// Previously this forced conservative mode, ignoring user's saved settings
-		if cfg.ResourceProfile == "" {
-			// No profile configured at all - use balanced as sensible default
-			cfg.ResourceProfile = "balanced"
-			if cfg.Debug {
-				log.Info("TUI mode: no profile configured, using 'balanced' default")
-			}
-		} else {
-			// User has a configured profile - RESPECT IT!
-			if cfg.Debug {
-				log.Info("TUI mode: respecting user-configured profile", "profile", cfg.ResourceProfile)
-			}
-		}
-		// Note: LargeDBMode is no longer forced - user controls it via settings
-
 		// Check authentication before starting TUI
 		if cfg.IsPostgreSQL() {
 			if mismatch, msg := auth.CheckAuthenticationMismatch(cfg); mismatch {
@@ -281,7 +265,7 @@ func runPreflight(ctx context.Context) error {
 
 	// 4. Disk space check
 	fmt.Print("[4] Available disk space... ")
-	if err := checkPreflightDiskSpace(); err != nil {
+	if err := checkDiskSpace(); err != nil {
 		fmt.Printf("[FAIL] FAILED: %v\n", err)
 	} else {
 		fmt.Println("[OK] PASSED")
@@ -361,7 +345,7 @@ func checkBackupDirectory() error {
 	return nil
 }
 
-func checkPreflightDiskSpace() error {
+func checkDiskSpace() error {
 	// Basic disk space check - this is a simplified version
 	// In a real implementation, you'd use syscall.Statfs or similar
 	if _, err := os.Stat(cfg.BackupDir); os.IsNotExist(err) {
@@ -398,6 +382,92 @@ func checkSystemResources() error {
 	return nil
 }
 
+// runRestore restores database from backup archive
+func runRestore(ctx context.Context, archiveName string) error {
+	fmt.Println("==============================================================")
+	fmt.Println(" Database Restore")
+	fmt.Println("==============================================================")
+
+	// Construct full path to archive
+	archivePath := filepath.Join(cfg.BackupDir, archiveName)
+
+	// Check if archive exists
+	if _, err := os.Stat(archivePath); os.IsNotExist(err) {
+		return fmt.Errorf("backup archive not found: %s", archivePath)
+	}
+
+	// Detect archive type
+	archiveType := detectArchiveType(archiveName)
+	fmt.Printf("Archive: %s\n", archiveName)
+	fmt.Printf("Type: %s\n", archiveType)
+	fmt.Printf("Location: %s\n", archivePath)
+	fmt.Println()
+
+	// Get archive info
+	stat, err := os.Stat(archivePath)
+	if err != nil {
+		return fmt.Errorf("cannot access archive: %w", err)
+	}
+
+	fmt.Printf("Size: %s\n", formatFileSize(stat.Size()))
+	fmt.Printf("Created: %s\n", stat.ModTime().Format("2006-01-02 15:04:05"))
+	fmt.Println()
+
+	// Show warning
+	fmt.Println("[WARN] WARNING: This will restore data to the target database.")
+	fmt.Println("   Existing data may be overwritten or merged depending on the restore method.")
+	fmt.Println()
+
+	// For safety, show what would be done without actually doing it
+	switch archiveType {
+	case "Single Database (.dump)":
+		fmt.Println("[EXEC] Would execute: pg_restore to restore single database")
+		fmt.Printf("   Command: pg_restore -h %s -p %d -U %s -d %s --verbose %s\n",
+			cfg.Host, cfg.Port, cfg.User, cfg.Database, archivePath)
+	case "Single Database (.dump.gz)":
+		fmt.Println("[EXEC] Would execute: gunzip and pg_restore to restore single database")
+		fmt.Printf("   Command: gunzip -c %s | pg_restore -h %s -p %d -U %s -d %s --verbose\n",
+			archivePath, cfg.Host, cfg.Port, cfg.User, cfg.Database)
+	case "SQL Script (.sql)":
+		if cfg.IsPostgreSQL() {
+			fmt.Println("[EXEC] Would execute: psql to run SQL script")
+			fmt.Printf("   Command: psql -h %s -p %d -U %s -d %s -f %s\n",
+				cfg.Host, cfg.Port, cfg.User, cfg.Database, archivePath)
+		} else if cfg.IsMySQL() {
+			fmt.Println("[EXEC] Would execute: mysql to run SQL script")
+			fmt.Printf("   Command: %s\n", mysqlRestoreCommand(archivePath, false))
+		} else {
+			fmt.Println("[EXEC] Would execute: SQL client to run script (database type unknown)")
+		}
+	case "SQL Script (.sql.gz)":
+		if cfg.IsPostgreSQL() {
+			fmt.Println("[EXEC] Would execute: gunzip and psql to run SQL script")
+			fmt.Printf("   Command: gunzip -c %s | psql -h %s -p %d -U %s -d %s\n",
+				archivePath, cfg.Host, cfg.Port, cfg.User, cfg.Database)
+		} else if cfg.IsMySQL() {
+			fmt.Println("[EXEC] Would execute: gunzip and mysql to run SQL script")
+			fmt.Printf("   Command: %s\n", mysqlRestoreCommand(archivePath, true))
+		} else {
+			fmt.Println("[EXEC] Would execute: gunzip and SQL client to run script (database type unknown)")
+		}
+	case "Cluster Backup (.tar.gz)":
+		fmt.Println("[EXEC] Would execute: Extract and restore cluster backup")
+		fmt.Println("   Steps:")
+		fmt.Println("   1. Extract tar.gz archive")
+		fmt.Println("   2. Restore global objects (roles, tablespaces)")
+		fmt.Println("   3. Restore individual databases")
+	default:
+		return fmt.Errorf("unsupported archive type: %s", archiveType)
+	}
+
+	fmt.Println()
+	fmt.Println("[SAFETY] SAFETY MODE: Restore command is in preview mode.")
+	fmt.Println("   This shows what would be executed without making changes.")
+	fmt.Println("   To enable actual restore, add --confirm flag (not yet implemented).")
+
+	return nil
+}
+
 func detectArchiveType(filename string) string {
 	switch {
 	case strings.HasSuffix(filename, ".dump.gz"):
@@ -423,13 +493,8 @@ func runVerify(ctx context.Context, archiveName string) error {
 	fmt.Println(" Backup Archive Verification")
 	fmt.Println("==============================================================")
 
-	// Construct full path to archive - use as-is if already absolute
-	var archivePath string
-	if filepath.IsAbs(archiveName) {
-		archivePath = archiveName
-	} else {
-		archivePath = filepath.Join(cfg.BackupDir, archiveName)
-	}
+	// Construct full path to archive
+	archivePath := filepath.Join(cfg.BackupDir, archiveName)
 
 	// Check if archive exists
 	if _, err := os.Stat(archivePath); os.IsNotExist(err) {
@@ -584,7 +649,7 @@ func verifyPgDumpGzip(path string) error {
 	}
 	defer file.Close()
 
-	gz, err := pgzip.NewReader(file)
+	gz, err := gzip.NewReader(file)
 	if err != nil {
 		return fmt.Errorf("failed to open gzip stream: %w", err)
 	}
@@ -633,7 +698,7 @@ func verifyGzipSqlScript(path string) error {
 	}
 	defer file.Close()
 
-	gz, err := pgzip.NewReader(file)
+	gz, err := gzip.NewReader(file)
 	if err != nil {
 		return fmt.Errorf("failed to open gzip stream: %w", err)
 	}
@@ -701,3 +766,33 @@ func containsSQLKeywords(content string) bool {
 
 	return false
 }
+
+func mysqlRestoreCommand(archivePath string, compressed bool) string {
+	parts := []string{"mysql"}
+
+	// Only add -h flag if host is not localhost (to use Unix socket)
+	if cfg.Host != "localhost" && cfg.Host != "127.0.0.1" && cfg.Host != "" {
+		parts = append(parts, "-h", cfg.Host)
+	}
+
+	parts = append(parts,
+		"-P", fmt.Sprintf("%d", cfg.Port),
+		"-u", cfg.User,
+	)
+
+	if cfg.Password != "" {
+		parts = append(parts, fmt.Sprintf("-p'%s'", cfg.Password))
+	}
+
+	if cfg.Database != "" {
+		parts = append(parts, cfg.Database)
+	}
+
+	command := strings.Join(parts, " ")
+
+	if compressed {
+		return fmt.Sprintf("gunzip -c %s | %s", archivePath, command)
+	}
+
+	return fmt.Sprintf("%s < %s", command, archivePath)
+}

cmd/profile.go

@@ -1,197 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"dbbackup/internal/engine/native"
-
-	"github.com/spf13/cobra"
-)
-
-var profileCmd = &cobra.Command{
-	Use:   "profile",
-	Short: "Profile system and show recommended settings",
-	Long: `Analyze system capabilities and database characteristics,
-then recommend optimal backup/restore settings.
-
-This command detects:
-  • CPU cores and speed
-  • Available RAM
-  • Disk type (SSD/HDD) and speed
-  • Database configuration (if connected)
-  • Workload characteristics (tables, indexes, BLOBs)
-
-Based on the analysis, it recommends optimal settings for:
-  • Worker parallelism
-  • Connection pool size
-  • Buffer sizes
-  • Batch sizes
-
-Examples:
-  # Profile system only (no database)
-  dbbackup profile
-
-  # Profile system and database
-  dbbackup profile --database mydb
-
-  # Profile with full database connection
-  dbbackup profile --host localhost --port 5432 --user admin --database mydb`,
-	RunE: runProfile,
-}
-
-var (
-	profileDatabase string
-	profileHost     string
-	profilePort     int
-	profileUser     string
-	profilePassword string
-	profileSSLMode  string
-	profileJSON     bool
-)
-
-func init() {
-	rootCmd.AddCommand(profileCmd)
-
-	profileCmd.Flags().StringVar(&profileDatabase, "database", "",
-		"Database to profile (optional, for database-specific recommendations)")
-	profileCmd.Flags().StringVar(&profileHost, "host", "localhost",
-		"Database host")
-	profileCmd.Flags().IntVar(&profilePort, "port", 5432,
-		"Database port")
-	profileCmd.Flags().StringVar(&profileUser, "user", "",
-		"Database user")
-	profileCmd.Flags().StringVar(&profilePassword, "password", "",
-		"Database password")
-	profileCmd.Flags().StringVar(&profileSSLMode, "sslmode", "prefer",
-		"SSL mode (disable, require, verify-ca, verify-full, prefer)")
-	profileCmd.Flags().BoolVar(&profileJSON, "json", false,
-		"Output in JSON format")
-}
-
-func runProfile(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-
-	// Build DSN if database specified
-	var dsn string
-	if profileDatabase != "" {
-		dsn = buildProfileDSN()
-	}
-
-	fmt.Println("🔍 Profiling system...")
-	if dsn != "" {
-		fmt.Println("📊 Connecting to database for workload analysis...")
-	}
-	fmt.Println()
-
-	// Detect system profile
-	profile, err := native.DetectSystemProfile(ctx, dsn)
-	if err != nil {
-		return fmt.Errorf("profile system: %w", err)
-	}
-
-	// Print profile
-	if profileJSON {
-		printProfileJSON(profile)
-	} else {
-		fmt.Print(profile.PrintProfile())
-		printExampleCommands(profile)
-	}
-
-	return nil
-}
-
-func buildProfileDSN() string {
-	user := profileUser
-	if user == "" {
-		user = "postgres"
-	}
-
-	dsn := fmt.Sprintf("postgres://%s", user)
-
-	if profilePassword != "" {
-		dsn += ":" + profilePassword
-	}
-
-	dsn += fmt.Sprintf("@%s:%d/%s", profileHost, profilePort, profileDatabase)
-
-	if profileSSLMode != "" {
-		dsn += "?sslmode=" + profileSSLMode
-	}
-
-	return dsn
-}
-
-func printExampleCommands(profile *native.SystemProfile) {
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║                    📋 EXAMPLE COMMANDS                       ║")
-	fmt.Println("╠══════════════════════════════════════════════════════════════╣")
-	fmt.Println("║                                                              ║")
-	fmt.Println("║ # Backup with auto-detected settings (recommended):         ║")
-	fmt.Println("║ dbbackup backup --database mydb --output backup.sql --auto  ║")
-	fmt.Println("║                                                              ║")
-	fmt.Println("║ # Backup with explicit recommended settings:                ║")
-	fmt.Printf("║ dbbackup backup --database mydb --output backup.sql \\       ║\n")
-	fmt.Printf("║   --workers=%d --pool-size=%d --buffer-size=%d              ║\n",
-		profile.RecommendedWorkers,
-		profile.RecommendedPoolSize,
-		profile.RecommendedBufferSize/1024)
-	fmt.Println("║                                                              ║")
-	fmt.Println("║ # Restore with auto-detected settings:                      ║")
-	fmt.Println("║ dbbackup restore backup.sql --database mydb --auto          ║")
-	fmt.Println("║                                                              ║")
-	fmt.Println("║ # Native engine restore with optimal settings:              ║")
-	fmt.Printf("║ dbbackup native-restore backup.sql --database mydb \\        ║\n")
-	fmt.Printf("║   --workers=%d --batch-size=%d                               ║\n",
-		profile.RecommendedWorkers,
-		profile.RecommendedBatchSize)
-	fmt.Println("║                                                              ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-}
-
-func printProfileJSON(profile *native.SystemProfile) {
-	fmt.Println("{")
-	fmt.Printf("  \"category\": \"%s\",\n", profile.Category)
-	fmt.Println("  \"cpu\": {")
-	fmt.Printf("    \"cores\": %d,\n", profile.CPUCores)
-	fmt.Printf("    \"speed_ghz\": %.2f,\n", profile.CPUSpeed)
-	fmt.Printf("    \"model\": \"%s\"\n", profile.CPUModel)
-	fmt.Println("  },")
-	fmt.Println("  \"memory\": {")
-	fmt.Printf("    \"total_bytes\": %d,\n", profile.TotalRAM)
-	fmt.Printf("    \"available_bytes\": %d,\n", profile.AvailableRAM)
-	fmt.Printf("    \"total_gb\": %.2f,\n", float64(profile.TotalRAM)/(1024*1024*1024))
-	fmt.Printf("    \"available_gb\": %.2f\n", float64(profile.AvailableRAM)/(1024*1024*1024))
-	fmt.Println("  },")
-	fmt.Println("  \"disk\": {")
-	fmt.Printf("    \"type\": \"%s\",\n", profile.DiskType)
-	fmt.Printf("    \"read_speed_mbps\": %d,\n", profile.DiskReadSpeed)
-	fmt.Printf("    \"write_speed_mbps\": %d,\n", profile.DiskWriteSpeed)
-	fmt.Printf("    \"free_space_bytes\": %d\n", profile.DiskFreeSpace)
-	fmt.Println("  },")
-
-	if profile.DBVersion != "" {
-		fmt.Println("  \"database\": {")
-		fmt.Printf("    \"version\": \"%s\",\n", profile.DBVersion)
-		fmt.Printf("    \"max_connections\": %d,\n", profile.DBMaxConnections)
-		fmt.Printf("    \"shared_buffers_bytes\": %d,\n", profile.DBSharedBuffers)
-		fmt.Printf("    \"estimated_size_bytes\": %d,\n", profile.EstimatedDBSize)
-		fmt.Printf("    \"estimated_rows\": %d,\n", profile.EstimatedRowCount)
-		fmt.Printf("    \"table_count\": %d,\n", profile.TableCount)
-		fmt.Printf("    \"has_blobs\": %v,\n", profile.HasBLOBs)
-		fmt.Printf("    \"has_indexes\": %v\n", profile.HasIndexes)
-		fmt.Println("  },")
-	}
-
-	fmt.Println("  \"recommendations\": {")
-	fmt.Printf("    \"workers\": %d,\n", profile.RecommendedWorkers)
-	fmt.Printf("    \"pool_size\": %d,\n", profile.RecommendedPoolSize)
-	fmt.Printf("    \"buffer_size_bytes\": %d,\n", profile.RecommendedBufferSize)
-	fmt.Printf("    \"batch_size\": %d\n", profile.RecommendedBatchSize)
-	fmt.Println("  },")
-	fmt.Printf("  \"detection_duration_ms\": %d\n", profile.DetectionDuration.Milliseconds())
-	fmt.Println("}")
-}

cmd/progress_webhooks.go

@@ -1,309 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"time"
-
-	"dbbackup/internal/notify"
-
-	"github.com/spf13/cobra"
-)
-
-var progressWebhooksCmd = &cobra.Command{
-	Use:   "progress-webhooks",
-	Short: "Configure and test progress webhook notifications",
-	Long: `Configure progress webhook notifications during backup/restore operations.
-
-Progress webhooks send periodic updates while operations are running:
-  - Bytes processed and percentage complete
-  - Tables/objects processed
-  - Estimated time remaining
-  - Current operation phase
-
-This allows external monitoring systems to track long-running operations
-in real-time without polling.
-
-Configuration:
-  - Set notification webhook URL and credentials via environment
-  - Configure update interval (default: 30s)
-
-Examples:
-  # Show current progress webhook configuration
-  dbbackup progress-webhooks status
-
-  # Show configuration instructions
-  dbbackup progress-webhooks enable --interval 60s
-
-  # Test progress webhooks with simulated backup
-  dbbackup progress-webhooks test
-
-  # Show disable instructions
-  dbbackup progress-webhooks disable`,
-}
-
-var progressWebhooksStatusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "Show progress webhook configuration",
-	Long:  `Display current progress webhook configuration and status.`,
-	RunE:  runProgressWebhooksStatus,
-}
-
-var progressWebhooksEnableCmd = &cobra.Command{
-	Use:   "enable",
-	Short: "Show how to enable progress webhook notifications",
-	Long:  `Display instructions for enabling progress webhook notifications.`,
-	RunE:  runProgressWebhooksEnable,
-}
-
-var progressWebhooksDisableCmd = &cobra.Command{
-	Use:   "disable",
-	Short: "Show how to disable progress webhook notifications",
-	Long:  `Display instructions for disabling progress webhook notifications.`,
-	RunE:  runProgressWebhooksDisable,
-}
-
-var progressWebhooksTestCmd = &cobra.Command{
-	Use:   "test",
-	Short: "Test progress webhooks with simulated backup",
-	Long:  `Send test progress webhook notifications with simulated backup progress.`,
-	RunE:  runProgressWebhooksTest,
-}
-
-var (
-	progressInterval time.Duration
-	progressFormat   string
-)
-
-func init() {
-	rootCmd.AddCommand(progressWebhooksCmd)
-
-	progressWebhooksCmd.AddCommand(progressWebhooksStatusCmd)
-	progressWebhooksCmd.AddCommand(progressWebhooksEnableCmd)
-	progressWebhooksCmd.AddCommand(progressWebhooksDisableCmd)
-	progressWebhooksCmd.AddCommand(progressWebhooksTestCmd)
-
-	progressWebhooksEnableCmd.Flags().DurationVar(&progressInterval, "interval", 30*time.Second, "Progress update interval")
-	progressWebhooksStatusCmd.Flags().StringVar(&progressFormat, "format", "text", "Output format (text, json)")
-	progressWebhooksTestCmd.Flags().DurationVar(&progressInterval, "interval", 5*time.Second, "Test progress update interval")
-}
-
-func runProgressWebhooksStatus(cmd *cobra.Command, args []string) error {
-	// Get notification configuration from environment
-	webhookURL := os.Getenv("DBBACKUP_WEBHOOK_URL")
-	smtpHost := os.Getenv("DBBACKUP_SMTP_HOST")
-	progressIntervalEnv := os.Getenv("DBBACKUP_PROGRESS_INTERVAL")
-
-	var interval time.Duration
-	if progressIntervalEnv != "" {
-		if d, err := time.ParseDuration(progressIntervalEnv); err == nil {
-			interval = d
-		}
-	}
-
-	status := ProgressWebhookStatus{
-		Enabled:     webhookURL != "" || smtpHost != "",
-		Interval:    interval,
-		WebhookURL:  webhookURL,
-		SMTPEnabled: smtpHost != "",
-	}
-
-	if progressFormat == "json" {
-		data, _ := json.MarshalIndent(status, "", "  ")
-		fmt.Println(string(data))
-		return nil
-	}
-
-	fmt.Println("[PROGRESS WEBHOOKS] Configuration Status")
-	fmt.Println("==========================================")
-	fmt.Println()
-
-	if status.Enabled {
-		fmt.Println("Status:          ✓ ENABLED")
-	} else {
-		fmt.Println("Status:          ✗ DISABLED")
-	}
-
-	if status.Interval > 0 {
-		fmt.Printf("Update Interval: %s\n", status.Interval)
-	} else {
-		fmt.Println("Update Interval: Not set (would use 30s default)")
-	}
-	fmt.Println()
-
-	fmt.Println("[NOTIFICATION BACKENDS]")
-	fmt.Println("==========================================")
-
-	if status.WebhookURL != "" {
-		fmt.Println("✓ Webhook:       Configured")
-		fmt.Printf("  URL:           %s\n", maskURL(status.WebhookURL))
-	} else {
-		fmt.Println("✗ Webhook:       Not configured")
-	}
-
-	if status.SMTPEnabled {
-		fmt.Println("✓ Email (SMTP):  Configured")
-	} else {
-		fmt.Println("✗ Email (SMTP):  Not configured")
-	}
-	fmt.Println()
-
-	if !status.Enabled {
-		fmt.Println("[SETUP INSTRUCTIONS]")
-		fmt.Println("==========================================")
-		fmt.Println()
-		fmt.Println("To enable progress webhooks, configure notification backend:")
-		fmt.Println()
-		fmt.Println("  export DBBACKUP_WEBHOOK_URL=https://your-webhook-url")
-		fmt.Println("  export DBBACKUP_PROGRESS_INTERVAL=30s")
-		fmt.Println()
-		fmt.Println("Or add to .dbbackup.conf:")
-		fmt.Println()
-		fmt.Println("  webhook_url: https://your-webhook-url")
-		fmt.Println("  progress_interval: 30s")
-		fmt.Println()
-		fmt.Println("Then test with:")
-		fmt.Println("  dbbackup progress-webhooks test")
-		fmt.Println()
-	}
-
-	return nil
-}
-
-func runProgressWebhooksEnable(cmd *cobra.Command, args []string) error {
-	webhookURL := os.Getenv("DBBACKUP_WEBHOOK_URL")
-	smtpHost := os.Getenv("DBBACKUP_SMTP_HOST")
-
-	if webhookURL == "" && smtpHost == "" {
-		fmt.Println("[PROGRESS WEBHOOKS] Setup Required")
-		fmt.Println("==========================================")
-		fmt.Println()
-		fmt.Println("No notification backend configured.")
-		fmt.Println()
-		fmt.Println("Configure webhook via environment:")
-		fmt.Println("  export DBBACKUP_WEBHOOK_URL=https://your-webhook-url")
-		fmt.Println()
-		fmt.Println("Or configure SMTP:")
-		fmt.Println("  export DBBACKUP_SMTP_HOST=smtp.example.com")
-		fmt.Println("  export DBBACKUP_SMTP_PORT=587")
-		fmt.Println("  export DBBACKUP_SMTP_USER=user@example.com")
-		fmt.Println()
-		return nil
-	}
-
-	fmt.Println("[PROGRESS WEBHOOKS] Configuration")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("To enable progress webhooks, add to your environment:")
-	fmt.Println()
-	fmt.Printf("  export DBBACKUP_PROGRESS_INTERVAL=%s\n", progressInterval)
-	fmt.Println()
-	fmt.Println("Or add to .dbbackup.conf:")
-	fmt.Println()
-	fmt.Printf("  progress_interval: %s\n", progressInterval)
-	fmt.Println()
-	fmt.Println("Progress updates will be sent to configured notification backends")
-	fmt.Println("during backup and restore operations.")
-	fmt.Println()
-
-	return nil
-}
-
-func runProgressWebhooksDisable(cmd *cobra.Command, args []string) error {
-	fmt.Println("[PROGRESS WEBHOOKS] Disable")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("To disable progress webhooks:")
-	fmt.Println()
-	fmt.Println("  unset DBBACKUP_PROGRESS_INTERVAL")
-	fmt.Println()
-	fmt.Println("Or remove from .dbbackup.conf:")
-	fmt.Println()
-	fmt.Println("  # progress_interval: 30s")
-	fmt.Println()
-
-	return nil
-}
-
-func runProgressWebhooksTest(cmd *cobra.Command, args []string) error {
-	webhookURL := os.Getenv("DBBACKUP_WEBHOOK_URL")
-	smtpHost := os.Getenv("DBBACKUP_SMTP_HOST")
-
-	if webhookURL == "" && smtpHost == "" {
-		return fmt.Errorf("no notification backend configured. Set DBBACKUP_WEBHOOK_URL or DBBACKUP_SMTP_HOST")
-	}
-
-	fmt.Println("[PROGRESS WEBHOOKS] Test Mode")
-	fmt.Println("==========================================")
-	fmt.Println()
-	fmt.Println("Simulating backup with progress updates...")
-	fmt.Printf("Update interval: %s\n", progressInterval)
-	fmt.Println()
-
-	// Create notification manager
-	notifyCfg := notify.Config{
-		WebhookEnabled: webhookURL != "",
-		WebhookURL:     webhookURL,
-		WebhookMethod:  "POST",
-		SMTPEnabled:    smtpHost != "",
-		SMTPHost:       smtpHost,
-		OnSuccess:      true,
-		OnFailure:      true,
-	}
-
-	manager := notify.NewManager(notifyCfg)
-
-	// Create progress tracker
-	tracker := notify.NewProgressTracker(manager, "testdb", "Backup")
-	tracker.SetTotals(1024*1024*1024, 10) // 1GB, 10 tables
-	tracker.Start(progressInterval)
-
-	defer tracker.Stop()
-
-	// Simulate backup progress
-	totalBytes := int64(1024 * 1024 * 1024)
-	totalTables := 10
-	steps := 5
-
-	for i := 1; i <= steps; i++ {
-		phase := fmt.Sprintf("Processing table %d/%d", i*2, totalTables)
-		tracker.SetPhase(phase)
-
-		bytesProcessed := totalBytes * int64(i) / int64(steps)
-		tablesProcessed := totalTables * i / steps
-
-		tracker.UpdateBytes(bytesProcessed)
-		tracker.UpdateTables(tablesProcessed)
-
-		progress := tracker.GetProgress()
-		fmt.Printf("[%d/%d] %s - %s\n", i, steps, phase, progress.FormatSummary())
-
-		if i < steps {
-			time.Sleep(progressInterval)
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("✓ Test completed")
-	fmt.Println()
-	fmt.Println("Check your notification backend for progress updates.")
-	fmt.Println("You should have received approximately 5 progress notifications.")
-	fmt.Println()
-
-	return nil
-}
-
-type ProgressWebhookStatus struct {
-	Enabled     bool          `json:"enabled"`
-	Interval    time.Duration `json:"interval"`
-	WebhookURL  string        `json:"webhook_url,omitempty"`
-	SMTPEnabled bool          `json:"smtp_enabled"`
-}
-
-func maskURL(url string) string {
-	if len(url) < 20 {
-		return url[:5] + "***"
-	}
-	return url[:20] + "***"
-}

cmd/report.go

@@ -86,7 +86,7 @@ func init() {
 
 	// Generate command flags
 	reportGenerateCmd.Flags().StringVarP(&reportType, "type", "t", "soc2", "Report type (soc2, gdpr, hipaa, pci-dss, iso27001)")
-	reportGenerateCmd.Flags().IntVar(&reportDays, "days", 90, "Number of days to include in report")
+	reportGenerateCmd.Flags().IntVarP(&reportDays, "days", "d", 90, "Number of days to include in report")
 	reportGenerateCmd.Flags().StringVar(&reportStartDate, "start", "", "Start date (YYYY-MM-DD)")
 	reportGenerateCmd.Flags().StringVar(&reportEndDate, "end", "", "End date (YYYY-MM-DD)")
 	reportGenerateCmd.Flags().StringVarP(&reportFormat, "format", "f", "markdown", "Output format (json, markdown, html)")
@@ -97,7 +97,7 @@ func init() {
 
 	// Summary command flags
 	reportSummaryCmd.Flags().StringVarP(&reportType, "type", "t", "soc2", "Report type")
-	reportSummaryCmd.Flags().IntVar(&reportDays, "days", 90, "Number of days to include")
+	reportSummaryCmd.Flags().IntVarP(&reportDays, "days", "d", 90, "Number of days to include")
 	reportSummaryCmd.Flags().StringVar(&reportCatalog, "catalog", "", "Path to backup catalog database")
 }
 

cmd/restore.go

@@ -13,45 +13,28 @@ import (
 
 	"dbbackup/internal/backup"
 	"dbbackup/internal/cloud"
-	"dbbackup/internal/config"
 	"dbbackup/internal/database"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/pitr"
-	"dbbackup/internal/progress"
 	"dbbackup/internal/restore"
 	"dbbackup/internal/security"
-	"dbbackup/internal/validation"
 
 	"github.com/spf13/cobra"
 )
 
 var (
-	restoreConfirm       bool
-	restoreDryRun        bool
-	restoreForce         bool
-	restoreClean         bool
-	restoreCreate        bool
-	restoreJobs          int
-	restoreParallelDBs   int    // Number of parallel database restores
-	restoreProfile       string // Resource profile: conservative, balanced, aggressive, turbo, max-performance
-	restoreTarget        string
-	restoreVerbose       bool
-	restoreNoProgress    bool
-	restoreNoTUI         bool // Disable TUI for maximum performance (benchmark mode)
-	restoreQuiet         bool // Suppress all output except errors
-	restoreWorkdir       string
-	restoreCleanCluster  bool
-	restoreDiagnose      bool   // Run diagnosis before restore
-	restoreSaveDebugLog  string // Path to save debug log on failure
-	restoreDebugLocks    bool   // Enable detailed lock debugging
-	restoreOOMProtection bool   // Enable OOM protection for large restores
-	restoreLowMemory     bool   // Force low-memory mode for constrained systems
-
-	// Single database extraction from cluster flags
-	restoreDatabase  string // Single database to extract/restore from cluster
-	restoreDatabases string // Comma-separated list of databases to extract
-	restoreOutputDir string // Extract to directory (no restore)
-	restoreListDBs   bool   // List databases in cluster backup
+	restoreConfirm      bool
+	restoreDryRun       bool
+	restoreForce        bool
+	restoreClean        bool
+	restoreCreate       bool
+	restoreJobs         int
+	restoreTarget       string
+	restoreVerbose      bool
+	restoreNoProgress   bool
+	restoreWorkdir      string
+	restoreCleanCluster bool
+	restoreDiagnose     bool   // Run diagnosis before restore
+	restoreSaveDebugLog string // Path to save debug log on failure
 
 	// Diagnose flags
 	diagnoseJSON     bool
@@ -128,9 +111,6 @@ Examples:
   # Restore to different database
   dbbackup restore single mydb.dump.gz --target mydb_test --confirm
 
-  # Memory-constrained server (single-threaded, minimal memory)
-  dbbackup restore single mydb.dump.gz --profile=conservative --confirm
-
   # Clean target database before restore
   dbbackup restore single mydb.sql.gz --clean --confirm
 
@@ -150,11 +130,6 @@ var restoreClusterCmd = &cobra.Command{
 This command restores all databases that were backed up together
 in a cluster backup operation.
 
-Single Database Extraction:
-  Use --list-databases to see available databases
-  Use --database to extract/restore a specific database
-  Use --output-dir to extract without restoring
-
 Safety features:
   - Dry-run by default (use --confirm to execute)
   - Archive validation and listing
@@ -162,36 +137,12 @@ Safety features:
   - Sequential database restoration
 
 Examples:
-  # List databases in cluster backup
-  dbbackup restore cluster backup.tar.gz --list-databases
-
-  # Extract single database (no restore)
-  dbbackup restore cluster backup.tar.gz --database myapp --output-dir /tmp/extract
-
-  # Restore single database from cluster
-  dbbackup restore cluster backup.tar.gz --database myapp --confirm
-
-  # Restore single database with different name
-  dbbackup restore cluster backup.tar.gz --database myapp --target myapp_test --confirm
-
-  # Extract multiple databases
-  dbbackup restore cluster backup.tar.gz --databases "app1,app2,app3" --output-dir /tmp/extract
-
   # Preview cluster restore
   dbbackup restore cluster cluster_backup_20240101_120000.tar.gz
 
   # Restore full cluster
   dbbackup restore cluster cluster_backup_20240101_120000.tar.gz --confirm
 
-	# Memory-constrained server (conservative profile)
-	dbbackup restore cluster cluster_backup.tar.gz --profile=conservative --confirm
-
-	# Maximum performance (dedicated server)
-	dbbackup restore cluster cluster_backup.tar.gz --profile=aggressive --confirm
-
-	# TURBO: 8 parallel jobs for fastest restore (like pg_restore -j8)
-	dbbackup restore cluster cluster_backup.tar.gz --profile=turbo --confirm
-
 	# Use parallel decompression
 	dbbackup restore cluster cluster_backup.tar.gz --jobs 4 --confirm
 
@@ -288,7 +239,7 @@ Use this when:
 Checks performed:
   - File format detection (custom dump vs SQL)
   - PGDMP signature verification
-  - Compression integrity validation (pgzip)
+  - Gzip integrity validation
   - COPY block termination check
   - pg_restore --list verification
   - Cluster archive structure validation
@@ -325,82 +276,26 @@ func init() {
 	restoreSingleCmd.Flags().BoolVar(&restoreClean, "clean", false, "Drop and recreate target database")
 	restoreSingleCmd.Flags().BoolVar(&restoreCreate, "create", false, "Create target database if it doesn't exist")
 	restoreSingleCmd.Flags().StringVar(&restoreTarget, "target", "", "Target database name (defaults to original)")
-	restoreSingleCmd.Flags().StringVar(&restoreProfile, "profile", "balanced", "Resource profile: conservative, balanced, turbo (--jobs=8), max-performance")
 	restoreSingleCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed restore progress")
 	restoreSingleCmd.Flags().BoolVar(&restoreNoProgress, "no-progress", false, "Disable progress indicators")
-	restoreSingleCmd.Flags().BoolVar(&restoreNoTUI, "no-tui", false, "Disable TUI for maximum performance (benchmark mode)")
-	restoreSingleCmd.Flags().BoolVar(&restoreQuiet, "quiet", false, "Suppress all output except errors")
-	restoreSingleCmd.Flags().IntVar(&restoreJobs, "jobs", 0, "Number of parallel pg_restore jobs (0 = auto, like pg_restore -j)")
 	restoreSingleCmd.Flags().StringVar(&restoreEncryptionKeyFile, "encryption-key-file", "", "Path to encryption key file (required for encrypted backups)")
 	restoreSingleCmd.Flags().StringVar(&restoreEncryptionKeyEnv, "encryption-key-env", "DBBACKUP_ENCRYPTION_KEY", "Environment variable containing encryption key")
 	restoreSingleCmd.Flags().BoolVar(&restoreDiagnose, "diagnose", false, "Run deep diagnosis before restore to detect corruption/truncation")
 	restoreSingleCmd.Flags().StringVar(&restoreSaveDebugLog, "save-debug-log", "", "Save detailed error report to file on failure (e.g., /tmp/restore-debug.json)")
-	restoreSingleCmd.Flags().BoolVar(&restoreDebugLocks, "debug-locks", false, "Enable detailed lock debugging (captures PostgreSQL config, Guard decisions, boost attempts)")
-	restoreSingleCmd.Flags().Bool("native", false, "Use pure Go native engine (no psql/pg_restore required)")
-	restoreSingleCmd.Flags().Bool("fallback-tools", false, "Fall back to external tools if native engine fails")
-	restoreSingleCmd.Flags().Bool("auto", true, "Auto-detect optimal settings based on system resources")
-	restoreSingleCmd.Flags().Int("workers", 0, "Number of parallel workers for native engine (0 = auto-detect)")
-	restoreSingleCmd.Flags().Int("pool-size", 0, "Connection pool size for native engine (0 = auto-detect)")
-	restoreSingleCmd.Flags().Int("buffer-size", 0, "Buffer size in KB for native engine (0 = auto-detect)")
-	restoreSingleCmd.Flags().Int("batch-size", 0, "Batch size for bulk operations (0 = auto-detect)")
 
 	// Cluster restore flags
-	restoreClusterCmd.Flags().BoolVar(&restoreListDBs, "list-databases", false, "List databases in cluster backup and exit")
-	restoreClusterCmd.Flags().StringVar(&restoreDatabase, "database", "", "Extract/restore single database from cluster")
-	restoreClusterCmd.Flags().StringVar(&restoreDatabases, "databases", "", "Extract multiple databases (comma-separated)")
-	restoreClusterCmd.Flags().StringVar(&restoreOutputDir, "output-dir", "", "Extract to directory without restoring (requires --database or --databases)")
 	restoreClusterCmd.Flags().BoolVar(&restoreConfirm, "confirm", false, "Confirm and execute restore (required)")
 	restoreClusterCmd.Flags().BoolVar(&restoreDryRun, "dry-run", false, "Show what would be done without executing")
 	restoreClusterCmd.Flags().BoolVar(&restoreForce, "force", false, "Skip safety checks and confirmations")
 	restoreClusterCmd.Flags().BoolVar(&restoreCleanCluster, "clean-cluster", false, "Drop all existing user databases before restore (disaster recovery)")
-	restoreClusterCmd.Flags().StringVar(&restoreProfile, "profile", "conservative", "Resource profile: conservative, balanced, turbo (--jobs=8), max-performance")
-	restoreClusterCmd.Flags().IntVar(&restoreJobs, "jobs", 0, "Number of parallel decompression jobs (0 = auto, overrides profile)")
-	restoreClusterCmd.Flags().IntVar(&restoreParallelDBs, "parallel-dbs", 0, "Number of databases to restore in parallel (0 = use profile, 1 = sequential, -1 = auto-detect, overrides profile)")
+	restoreClusterCmd.Flags().IntVar(&restoreJobs, "jobs", 0, "Number of parallel decompression jobs (0 = auto)")
 	restoreClusterCmd.Flags().StringVar(&restoreWorkdir, "workdir", "", "Working directory for extraction (use when system disk is small, e.g. /mnt/storage/restore_tmp)")
 	restoreClusterCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed restore progress")
 	restoreClusterCmd.Flags().BoolVar(&restoreNoProgress, "no-progress", false, "Disable progress indicators")
-	restoreClusterCmd.Flags().BoolVar(&restoreNoTUI, "no-tui", false, "Disable TUI for maximum performance (benchmark mode)")
-	restoreClusterCmd.Flags().BoolVar(&restoreQuiet, "quiet", false, "Suppress all output except errors")
 	restoreClusterCmd.Flags().StringVar(&restoreEncryptionKeyFile, "encryption-key-file", "", "Path to encryption key file (required for encrypted backups)")
 	restoreClusterCmd.Flags().StringVar(&restoreEncryptionKeyEnv, "encryption-key-env", "DBBACKUP_ENCRYPTION_KEY", "Environment variable containing encryption key")
 	restoreClusterCmd.Flags().BoolVar(&restoreDiagnose, "diagnose", false, "Run deep diagnosis on all dumps before restore")
 	restoreClusterCmd.Flags().StringVar(&restoreSaveDebugLog, "save-debug-log", "", "Save detailed error report to file on failure (e.g., /tmp/restore-debug.json)")
-	restoreClusterCmd.Flags().BoolVar(&restoreDebugLocks, "debug-locks", false, "Enable detailed lock debugging (captures PostgreSQL config, Guard decisions, boost attempts)")
-	restoreClusterCmd.Flags().BoolVar(&restoreClean, "clean", false, "Drop and recreate target database (for single DB restore)")
-	restoreClusterCmd.Flags().BoolVar(&restoreCreate, "create", false, "Create target database if it doesn't exist (for single DB restore)")
-	restoreClusterCmd.Flags().BoolVar(&restoreOOMProtection, "oom-protection", false, "Enable OOM protection: disable swap, tune PostgreSQL memory, protect from OOM killer")
-	restoreClusterCmd.Flags().BoolVar(&restoreLowMemory, "low-memory", false, "Force low-memory mode: single-threaded restore with minimal memory (use for <8GB RAM or very large backups)")
-	restoreClusterCmd.Flags().Bool("native", false, "Use pure Go native engine for .sql.gz files (no psql/pg_restore required)")
-	restoreClusterCmd.Flags().Bool("fallback-tools", false, "Fall back to external tools if native engine fails")
-	restoreClusterCmd.Flags().Bool("auto", true, "Auto-detect optimal settings based on system resources")
-	restoreClusterCmd.Flags().Int("workers", 0, "Number of parallel workers for native engine (0 = auto-detect)")
-	restoreClusterCmd.Flags().Int("pool-size", 0, "Connection pool size for native engine (0 = auto-detect)")
-	restoreClusterCmd.Flags().Int("buffer-size", 0, "Buffer size in KB for native engine (0 = auto-detect)")
-	restoreClusterCmd.Flags().Int("batch-size", 0, "Batch size for bulk operations (0 = auto-detect)")
-
-	// Handle native engine flags for restore commands
-	for _, cmd := range []*cobra.Command{restoreSingleCmd, restoreClusterCmd} {
-		originalPreRun := cmd.PreRunE
-		cmd.PreRunE = func(c *cobra.Command, args []string) error {
-			if originalPreRun != nil {
-				if err := originalPreRun(c, args); err != nil {
-					return err
-				}
-			}
-			if c.Flags().Changed("native") {
-				native, _ := c.Flags().GetBool("native")
-				cfg.UseNativeEngine = native
-				if native {
-					log.Info("Native engine mode enabled for restore")
-				}
-			}
-			if c.Flags().Changed("fallback-tools") {
-				fallback, _ := c.Flags().GetBool("fallback-tools")
-				cfg.FallbackToTools = fallback
-			}
-			return nil
-		}
-	}
 
 	// PITR restore flags
 	restorePITRCmd.Flags().StringVar(&pitrBaseBackup, "base-backup", "", "Path to base backup file (.tar.gz) (required)")
@@ -539,21 +434,6 @@ func runRestoreDiagnose(cmd *cobra.Command, args []string) error {
 func runRestoreSingle(cmd *cobra.Command, args []string) error {
 	archivePath := args[0]
 
-	// Apply resource profile
-	if err := config.ApplyProfile(cfg, restoreProfile, restoreJobs, 0); err != nil {
-		log.Warn("Invalid profile, using balanced", "error", err)
-		restoreProfile = "balanced"
-		_ = config.ApplyProfile(cfg, restoreProfile, restoreJobs, 0)
-	}
-	if cfg.Debug && restoreProfile != "balanced" {
-		log.Info("Using restore profile", "profile", restoreProfile)
-	}
-
-	// Validate restore parameters
-	if err := validateRestoreParams(cfg, restoreTarget, restoreJobs); err != nil {
-		return fmt.Errorf("validation error: %w", err)
-	}
-
 	// Check if this is a cloud URI
 	var cleanupFunc func() error
 
@@ -651,15 +531,13 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf("disk space check failed: %w", err)
 		}
 
-		// Verify tools (skip if using native engine)
-		if !cfg.UseNativeEngine {
-			dbType := "postgres"
-			if format.IsMySQL() {
-				dbType = "mysql"
-			}
-			if err := safety.VerifyTools(dbType); err != nil {
-				return fmt.Errorf("tool verification failed: %w", err)
-			}
+		// Verify tools
+		dbType := "postgres"
+		if format.IsMySQL() {
+			dbType = "mysql"
+		}
+		if err := safety.VerifyTools(dbType); err != nil {
+			return fmt.Errorf("tool verification failed: %w", err)
 		}
 	}
 
@@ -694,12 +572,6 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 		log.Info("Debug logging enabled", "output", restoreSaveDebugLog)
 	}
 
-	// Enable lock debugging if requested (single restore)
-	if restoreDebugLocks {
-		cfg.DebugLocks = true
-		log.Info("🔍 Lock debugging enabled - will capture PostgreSQL lock config, Guard decisions, boost attempts")
-	}
-
 	// Setup signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -753,53 +625,14 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 	startTime := time.Now()
 	auditLogger.LogRestoreStart(user, targetDB, archivePath)
 
-	// Notify: restore started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreStarted, notify.SeverityInfo, "Database restore started").
-			WithDatabase(targetDB).
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
-	// Check if native engine should be used for restore
-	if cfg.UseNativeEngine {
-		log.Info("Using native engine for restore", "database", targetDB)
-		err = runNativeRestore(ctx, db, archivePath, targetDB, restoreClean, restoreCreate, startTime, user)
-
-		if err != nil && cfg.FallbackToTools {
-			log.Warn("Native engine restore failed, falling back to external tools", "error", err)
-			// Continue with tool-based restore below
-		} else {
-			// Native engine succeeded or no fallback configured
-			if err == nil {
-				log.Info("[OK] Restore completed successfully (native engine)", "database", targetDB)
-			}
-			return err
-		}
-	}
-
 	if err := engine.RestoreSingle(ctx, archivePath, targetDB, restoreClean, restoreCreate); err != nil {
 		auditLogger.LogRestoreFailed(user, targetDB, err)
-		// Notify: restore failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventRestoreFailed, notify.SeverityError, "Database restore failed").
-				WithDatabase(targetDB).
-				WithError(err).
-				WithDuration(time.Since(startTime)))
-		}
 		return fmt.Errorf("restore failed: %w", err)
 	}
 
 	// Audit log: restore success
 	auditLogger.LogRestoreComplete(user, targetDB, time.Since(startTime))
 
-	// Notify: restore completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreCompleted, notify.SeveritySuccess, "Database restore completed successfully").
-			WithDatabase(targetDB).
-			WithDuration(time.Since(startTime)).
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
 	log.Info("[OK] Restore completed successfully", "database", targetDB)
 	return nil
 }
@@ -822,208 +655,6 @@ func runRestoreCluster(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("archive not found: %s", archivePath)
 	}
 
-	// Handle --list-databases flag
-	if restoreListDBs {
-		return runListDatabases(archivePath)
-	}
-
-	// Handle single/multiple database extraction
-	if restoreDatabase != "" || restoreDatabases != "" {
-		return runExtractDatabases(archivePath)
-	}
-
-	// Otherwise proceed with full cluster restore
-	return runFullClusterRestore(archivePath)
-}
-
-// runListDatabases lists all databases in a cluster backup
-func runListDatabases(archivePath string) error {
-	ctx := context.Background()
-
-	log.Info("Scanning cluster backup", "archive", filepath.Base(archivePath))
-	fmt.Println()
-
-	databases, err := restore.ListDatabasesInCluster(ctx, archivePath, log)
-	if err != nil {
-		return fmt.Errorf("failed to list databases: %w", err)
-	}
-
-	fmt.Printf("📦 Databases in cluster backup:\n")
-	var totalSize int64
-	for _, db := range databases {
-		sizeStr := formatSize(db.Size)
-		fmt.Printf("  - %-30s (%s)\n", db.Name, sizeStr)
-		totalSize += db.Size
-	}
-
-	fmt.Printf("\nTotal: %s across %d database(s)\n", formatSize(totalSize), len(databases))
-	return nil
-}
-
-// runExtractDatabases extracts single or multiple databases from cluster backup
-func runExtractDatabases(archivePath string) error {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Setup signal handling
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-	defer signal.Stop(sigChan)
-
-	go func() {
-		<-sigChan
-		log.Warn("Extraction interrupted by user")
-		cancel()
-	}()
-
-	// Single database extraction
-	if restoreDatabase != "" {
-		return handleSingleDatabaseExtraction(ctx, archivePath, restoreDatabase)
-	}
-
-	// Multiple database extraction
-	if restoreDatabases != "" {
-		return handleMultipleDatabaseExtraction(ctx, archivePath, restoreDatabases)
-	}
-
-	return nil
-}
-
-// handleSingleDatabaseExtraction handles single database extraction or restore
-func handleSingleDatabaseExtraction(ctx context.Context, archivePath, dbName string) error {
-	// Extract-only mode (no restore)
-	if restoreOutputDir != "" {
-		return extractSingleDatabase(ctx, archivePath, dbName, restoreOutputDir)
-	}
-
-	// Restore mode
-	if !restoreConfirm {
-		fmt.Println("\n[DRY-RUN] DRY-RUN MODE - No changes will be made")
-		fmt.Printf("\nWould extract and restore:\n")
-		fmt.Printf("  Database: %s\n", dbName)
-		fmt.Printf("  From: %s\n", archivePath)
-		targetDB := restoreTarget
-		if targetDB == "" {
-			targetDB = dbName
-		}
-		fmt.Printf("  Target: %s\n", targetDB)
-		if restoreClean {
-			fmt.Printf("  Clean: true (drop and recreate)\n")
-		}
-		if restoreCreate {
-			fmt.Printf("  Create: true (create if missing)\n")
-		}
-		fmt.Println("\nTo execute this restore, add --confirm flag")
-		return nil
-	}
-
-	// Create database instance
-	db, err := database.New(cfg, log)
-	if err != nil {
-		return fmt.Errorf("failed to create database instance: %w", err)
-	}
-	defer db.Close()
-
-	// Create restore engine
-	engine := restore.New(cfg, log, db)
-
-	// Determine target database name
-	targetDB := restoreTarget
-	if targetDB == "" {
-		targetDB = dbName
-	}
-
-	log.Info("Restoring single database from cluster", "database", dbName, "target", targetDB)
-
-	// Restore single database from cluster
-	if err := engine.RestoreSingleFromCluster(ctx, archivePath, dbName, targetDB, restoreClean, restoreCreate); err != nil {
-		return fmt.Errorf("restore failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Successfully restored '%s' as '%s'\n", dbName, targetDB)
-	return nil
-}
-
-// extractSingleDatabase extracts a single database without restoring
-func extractSingleDatabase(ctx context.Context, archivePath, dbName, outputDir string) error {
-	log.Info("Extracting database", "database", dbName, "output", outputDir)
-
-	// Create progress indicator
-	prog := progress.NewIndicator(!restoreNoProgress, "dots")
-
-	extractedPath, err := restore.ExtractDatabaseFromCluster(ctx, archivePath, dbName, outputDir, log, prog)
-	if err != nil {
-		return fmt.Errorf("extraction failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Extracted: %s\n", extractedPath)
-	fmt.Printf("   Database: %s\n", dbName)
-	fmt.Printf("   Location: %s\n", outputDir)
-	return nil
-}
-
-// handleMultipleDatabaseExtraction handles multiple database extraction
-func handleMultipleDatabaseExtraction(ctx context.Context, archivePath, databases string) error {
-	if restoreOutputDir == "" {
-		return fmt.Errorf("--output-dir required when using --databases")
-	}
-
-	// Parse database list
-	dbNames := strings.Split(databases, ",")
-	for i := range dbNames {
-		dbNames[i] = strings.TrimSpace(dbNames[i])
-	}
-
-	log.Info("Extracting multiple databases", "count", len(dbNames), "output", restoreOutputDir)
-
-	// Create progress indicator
-	prog := progress.NewIndicator(!restoreNoProgress, "dots")
-
-	extractedPaths, err := restore.ExtractMultipleDatabasesFromCluster(ctx, archivePath, dbNames, restoreOutputDir, log, prog)
-	if err != nil {
-		return fmt.Errorf("extraction failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Extracted %d database(s):\n", len(extractedPaths))
-	for dbName, path := range extractedPaths {
-		fmt.Printf("   - %s → %s\n", dbName, filepath.Base(path))
-	}
-	fmt.Printf("   Location: %s\n", restoreOutputDir)
-	return nil
-}
-
-// runFullClusterRestore performs a full cluster restore
-func runFullClusterRestore(archivePath string) error {
-
-	// Apply resource profile
-	if err := config.ApplyProfile(cfg, restoreProfile, restoreJobs, restoreParallelDBs); err != nil {
-		log.Warn("Invalid profile, using balanced", "error", err)
-		restoreProfile = "balanced"
-		_ = config.ApplyProfile(cfg, restoreProfile, restoreJobs, restoreParallelDBs)
-	}
-	if cfg.Debug || restoreProfile != "balanced" {
-		log.Info("Using restore profile", "profile", restoreProfile, "parallel_dbs", cfg.ClusterParallelism, "jobs", cfg.Jobs)
-	}
-
-	// Validate restore parameters
-	if err := validateRestoreParams(cfg, restoreTarget, restoreJobs); err != nil {
-		return fmt.Errorf("validation error: %w", err)
-	}
-
-	// Convert to absolute path
-	if !filepath.IsAbs(archivePath) {
-		absPath, err := filepath.Abs(archivePath)
-		if err != nil {
-			return fmt.Errorf("invalid archive path: %w", err)
-		}
-		archivePath = absPath
-	}
-
-	// Check if file exists
-	if _, err := os.Stat(archivePath); err != nil {
-		return fmt.Errorf("archive not found: %s", archivePath)
-	}
-
 	// Check if backup is encrypted and decrypt if necessary
 	if backup.IsBackupEncrypted(archivePath) {
 		log.Info("Encrypted cluster backup detected, decrypting...")
@@ -1081,11 +712,9 @@ func runFullClusterRestore(archivePath string) error {
 			return fmt.Errorf("disk space check failed: %w", err)
 		}
 
-		// Verify tools (skip if using native engine)
-		if !cfg.UseNativeEngine {
-			if err := safety.VerifyTools("postgres"); err != nil {
-				return fmt.Errorf("tool verification failed: %w", err)
-			}
+		// Verify tools (assume PostgreSQL for cluster backups)
+		if err := safety.VerifyTools("postgres"); err != nil {
+			return fmt.Errorf("tool verification failed: %w", err)
 		}
 	} // Create database instance for pre-checks
 	db, err := database.New(cfg, log)
@@ -1154,17 +783,6 @@ func runFullClusterRestore(archivePath string) error {
 		}
 	}
 
-	// Override cluster parallelism if --parallel-dbs is specified
-	if restoreParallelDBs == -1 {
-		// Auto-detect optimal parallelism based on system resources
-		autoParallel := restore.CalculateOptimalParallel()
-		cfg.ClusterParallelism = autoParallel
-		log.Info("Auto-detected optimal parallelism for database restores", "parallel_dbs", autoParallel, "mode", "auto")
-	} else if restoreParallelDBs > 0 {
-		cfg.ClusterParallelism = restoreParallelDBs
-		log.Info("Using custom parallelism for database restores", "parallel_dbs", restoreParallelDBs)
-	}
-
 	// Create restore engine
 	engine := restore.New(cfg, log, db)
 
@@ -1174,12 +792,6 @@ func runFullClusterRestore(archivePath string) error {
 		log.Info("Debug logging enabled", "output", restoreSaveDebugLog)
 	}
 
-	// Enable lock debugging if requested (cluster restore)
-	if restoreDebugLocks {
-		cfg.DebugLocks = true
-		log.Info("🔍 Lock debugging enabled - will capture PostgreSQL lock config, Guard decisions, boost attempts")
-	}
-
 	// Setup signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -1215,50 +827,22 @@ func runFullClusterRestore(archivePath string) error {
 		log.Info("Database cleanup completed")
 	}
 
-	// OPTIMIZATION: Pre-extract archive once for both diagnosis and restore
-	// This avoids extracting the same tar.gz twice (saves 5-10 min on large clusters)
-	var extractedDir string
-	var extractErr error
-
-	if restoreDiagnose || restoreConfirm {
-		log.Info("Pre-extracting cluster archive (shared for validation and restore)...")
-		extractedDir, extractErr = safety.ValidateAndExtractCluster(ctx, archivePath)
-		if extractErr != nil {
-			return fmt.Errorf("failed to extract cluster archive: %w", extractErr)
-		}
-		defer os.RemoveAll(extractedDir) // Cleanup at end
-		log.Info("Archive extracted successfully", "location", extractedDir)
-	}
-
-	// Run pre-restore diagnosis if requested (using already-extracted directory)
+	// Run pre-restore diagnosis if requested
 	if restoreDiagnose {
-		log.Info("[DIAG] Running pre-restore diagnosis on extracted dumps...")
+		log.Info("[DIAG] Running pre-restore diagnosis...")
+
+		// Create temp directory for extraction in configured WorkDir
+		workDir := cfg.GetEffectiveWorkDir()
+		diagTempDir, err := os.MkdirTemp(workDir, "dbbackup-diagnose-*")
+		if err != nil {
+			return fmt.Errorf("failed to create temp directory for diagnosis in %s: %w", workDir, err)
+		}
+		defer os.RemoveAll(diagTempDir)
 
 		diagnoser := restore.NewDiagnoser(log, restoreVerbose)
-		// Diagnose dumps directly from extracted directory
-		dumpsDir := filepath.Join(extractedDir, "dumps")
-		if _, err := os.Stat(dumpsDir); err != nil {
-			return fmt.Errorf("no dumps directory found in extracted archive: %w", err)
-		}
-
-		entries, err := os.ReadDir(dumpsDir)
+		results, err := diagnoser.DiagnoseClusterDumps(archivePath, diagTempDir)
 		if err != nil {
-			return fmt.Errorf("failed to read dumps directory: %w", err)
-		}
-
-		// Diagnose each dump file
-		var results []*restore.DiagnoseResult
-		for _, entry := range entries {
-			if entry.IsDir() {
-				continue
-			}
-			dumpPath := filepath.Join(dumpsDir, entry.Name())
-			result, err := diagnoser.DiagnoseFile(dumpPath)
-			if err != nil {
-				log.Warn("Could not diagnose dump", "file", entry.Name(), "error", err)
-				continue
-			}
-			results = append(results, result)
+			return fmt.Errorf("diagnosis failed: %w", err)
 		}
 
 		// Check for any invalid dumps
@@ -1298,36 +882,14 @@ func runFullClusterRestore(archivePath string) error {
 	startTime := time.Now()
 	auditLogger.LogRestoreStart(user, "all_databases", archivePath)
 
-	// Notify: restore started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreStarted, notify.SeverityInfo, "Cluster restore started").
-			WithDatabase("all_databases").
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
-	// Pass pre-extracted directory to avoid double extraction
-	if err := engine.RestoreCluster(ctx, archivePath, extractedDir); err != nil {
+	if err := engine.RestoreCluster(ctx, archivePath); err != nil {
 		auditLogger.LogRestoreFailed(user, "all_databases", err)
-		// Notify: restore failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventRestoreFailed, notify.SeverityError, "Cluster restore failed").
-				WithDatabase("all_databases").
-				WithError(err).
-				WithDuration(time.Since(startTime)))
-		}
 		return fmt.Errorf("cluster restore failed: %w", err)
 	}
 
 	// Audit log: restore success
 	auditLogger.LogRestoreComplete(user, "all_databases", time.Since(startTime))
 
-	// Notify: restore completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreCompleted, notify.SeveritySuccess, "Cluster restore completed successfully").
-			WithDatabase("all_databases").
-			WithDuration(time.Since(startTime)))
-	}
-
 	log.Info("[OK] Cluster restore completed successfully")
 	return nil
 }
@@ -1523,56 +1085,3 @@ func runRestorePITR(cmd *cobra.Command, args []string) error {
 	log.Info("[OK] PITR restore completed successfully")
 	return nil
 }
-
-// validateRestoreParams performs comprehensive input validation for restore parameters
-func validateRestoreParams(cfg *config.Config, targetDB string, jobs int) error {
-	var errs []string
-
-	// Validate target database name if specified
-	if targetDB != "" {
-		if err := validation.ValidateDatabaseName(targetDB, cfg.DatabaseType); err != nil {
-			errs = append(errs, fmt.Sprintf("target database: %s", err))
-		}
-	}
-
-	// Validate job count
-	if jobs > 0 {
-		if err := validation.ValidateJobs(jobs); err != nil {
-			errs = append(errs, fmt.Sprintf("jobs: %s", err))
-		}
-	}
-
-	// Validate host
-	if cfg.Host != "" {
-		if err := validation.ValidateHost(cfg.Host); err != nil {
-			errs = append(errs, fmt.Sprintf("host: %s", err))
-		}
-	}
-
-	// Validate port
-	if cfg.Port > 0 {
-		if err := validation.ValidatePort(cfg.Port); err != nil {
-			errs = append(errs, fmt.Sprintf("port: %s", err))
-		}
-	}
-
-	// Validate workdir if specified
-	if restoreWorkdir != "" {
-		if err := validation.ValidateBackupDir(restoreWorkdir); err != nil {
-			errs = append(errs, fmt.Sprintf("workdir: %s", err))
-		}
-	}
-
-	// Validate output dir if specified
-	if restoreOutputDir != "" {
-		if err := validation.ValidateBackupDir(restoreOutputDir); err != nil {
-			errs = append(errs, fmt.Sprintf("output directory: %s", err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return fmt.Errorf("validation failed: %s", strings.Join(errs, "; "))
-	}
-
-	return nil
-}

cmd/restore_preview.go

@@ -1,328 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/dustin/go-humanize"
-	"github.com/spf13/cobra"
-
-	"dbbackup/internal/restore"
-)
-
-var (
-	previewCompareSchema bool
-	previewEstimate      bool
-)
-
-var restorePreviewCmd = &cobra.Command{
-	Use:   "preview [archive-file]",
-	Short: "Preview backup contents before restoring",
-	Long: `Show detailed information about what a backup contains before actually restoring it.
-
-This command analyzes backup archives and provides:
-  - Database name, version, and size information
-  - Table count and largest tables
-  - Estimated restore time based on system resources
-  - Required disk space
-  - Schema comparison with current database (optional)
-  - Resource recommendations
-
-Use this to:
-  - See what you'll get before committing to a long restore
-  - Estimate restore time and resource requirements
-  - Identify schema changes since backup was created
-  - Verify backup contains expected data
-
-Examples:
-  # Preview a backup
-  dbbackup restore preview mydb.dump.gz
-
-  # Preview with restore time estimation
-  dbbackup restore preview mydb.dump.gz --estimate
-
-  # Preview with schema comparison to current database
-  dbbackup restore preview mydb.dump.gz --compare-schema
-
-  # Preview cluster backup
-  dbbackup restore preview cluster_backup.tar.gz
-`,
-	Args: cobra.ExactArgs(1),
-	RunE: runRestorePreview,
-}
-
-func init() {
-	restoreCmd.AddCommand(restorePreviewCmd)
-
-	restorePreviewCmd.Flags().BoolVar(&previewCompareSchema, "compare-schema", false, "Compare backup schema with current database")
-	restorePreviewCmd.Flags().BoolVar(&previewEstimate, "estimate", true, "Estimate restore time and resource requirements")
-	restorePreviewCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed analysis")
-}
-
-func runRestorePreview(cmd *cobra.Command, args []string) error {
-	archivePath := args[0]
-
-	// Convert to absolute path
-	if !filepath.IsAbs(archivePath) {
-		absPath, err := filepath.Abs(archivePath)
-		if err != nil {
-			return fmt.Errorf("invalid archive path: %w", err)
-		}
-		archivePath = absPath
-	}
-
-	// Check if file exists
-	stat, err := os.Stat(archivePath)
-	if err != nil {
-		return fmt.Errorf("archive not found: %s", archivePath)
-	}
-
-	fmt.Printf("\n%s\n", strings.Repeat("=", 70))
-	fmt.Printf("BACKUP PREVIEW: %s\n", filepath.Base(archivePath))
-	fmt.Printf("%s\n\n", strings.Repeat("=", 70))
-
-	// Get file info
-	fileSize := stat.Size()
-	fmt.Printf("File Information:\n")
-	fmt.Printf("  Path:         %s\n", archivePath)
-	fmt.Printf("  Size:         %s (%d bytes)\n", humanize.Bytes(uint64(fileSize)), fileSize)
-	fmt.Printf("  Modified:     %s\n", stat.ModTime().Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Age:          %s\n", humanize.Time(stat.ModTime()))
-	fmt.Println()
-
-	// Detect format
-	format := restore.DetectArchiveFormat(archivePath)
-	fmt.Printf("Format Detection:\n")
-	fmt.Printf("  Type:         %s\n", format.String())
-
-	if format.IsCompressed() {
-		fmt.Printf("  Compressed:   Yes\n")
-	} else {
-		fmt.Printf("  Compressed:   No\n")
-	}
-	fmt.Println()
-
-	// Run diagnosis
-	diagnoser := restore.NewDiagnoser(log, restoreVerbose)
-	result, err := diagnoser.DiagnoseFile(archivePath)
-	if err != nil {
-		return fmt.Errorf("failed to analyze backup: %w", err)
-	}
-
-	// Database information
-	fmt.Printf("Database Information:\n")
-
-	if format.IsClusterBackup() {
-		// For cluster backups, extract database list
-		fmt.Printf("  Type:         Cluster Backup (multiple databases)\n")
-
-		// Try to list databases
-		if dbList, err := listDatabasesInCluster(archivePath); err == nil && len(dbList) > 0 {
-			fmt.Printf("  Databases:    %d\n", len(dbList))
-			fmt.Printf("\n  Database List:\n")
-			for _, db := range dbList {
-				fmt.Printf("    - %s\n", db)
-			}
-		} else {
-			fmt.Printf("  Databases:    Multiple (use --list-databases to see all)\n")
-		}
-	} else {
-		// Single database backup
-		dbName := extractDatabaseName(archivePath, result)
-		fmt.Printf("  Database:     %s\n", dbName)
-
-		if result.Details != nil && result.Details.TableCount > 0 {
-			fmt.Printf("  Tables:       %d\n", result.Details.TableCount)
-
-			if len(result.Details.TableList) > 0 {
-				fmt.Printf("\n  Largest Tables (top 5):\n")
-				displayCount := 5
-				if len(result.Details.TableList) < displayCount {
-					displayCount = len(result.Details.TableList)
-				}
-				for i := 0; i < displayCount; i++ {
-					fmt.Printf("    - %s\n", result.Details.TableList[i])
-				}
-				if len(result.Details.TableList) > 5 {
-					fmt.Printf("    ... and %d more\n", len(result.Details.TableList)-5)
-				}
-			}
-		}
-	}
-	fmt.Println()
-
-	// Size estimation
-	if result.Details != nil && result.Details.ExpandedSize > 0 {
-		fmt.Printf("Size Estimates:\n")
-		fmt.Printf("  Compressed:   %s\n", humanize.Bytes(uint64(fileSize)))
-		fmt.Printf("  Uncompressed: %s\n", humanize.Bytes(uint64(result.Details.ExpandedSize)))
-
-		if result.Details.CompressionRatio > 0 {
-			fmt.Printf("  Ratio:        %.1f%% (%.2fx compression)\n",
-				result.Details.CompressionRatio*100,
-				float64(result.Details.ExpandedSize)/float64(fileSize))
-		}
-
-		// Estimate disk space needed (uncompressed + indexes + temp space)
-		estimatedDisk := int64(float64(result.Details.ExpandedSize) * 1.5) // 1.5x for indexes and temp
-		fmt.Printf("  Disk needed:  %s (including indexes and temporary space)\n",
-			humanize.Bytes(uint64(estimatedDisk)))
-		fmt.Println()
-	}
-
-	// Restore time estimation
-	if previewEstimate {
-		fmt.Printf("Restore Estimates:\n")
-
-		// Apply current profile
-		profile := cfg.GetCurrentProfile()
-		if profile != nil {
-			fmt.Printf("  Profile:      %s (P:%d J:%d)\n",
-				profile.Name, profile.ClusterParallelism, profile.Jobs)
-		}
-
-		// Estimate extraction time
-		extractionSpeed := int64(500 * 1024 * 1024) // 500 MB/s typical
-		extractionTime := time.Duration(fileSize/extractionSpeed) * time.Second
-
-		fmt.Printf("  Extract time: ~%s\n", formatDuration(extractionTime))
-
-		// Estimate restore time (depends on data size and parallelism)
-		if result.Details != nil && result.Details.ExpandedSize > 0 {
-			// Rough estimate: 50MB/s per job for PostgreSQL restore
-			restoreSpeed := int64(50 * 1024 * 1024)
-			if profile != nil {
-				restoreSpeed *= int64(profile.Jobs)
-			}
-			restoreTime := time.Duration(result.Details.ExpandedSize/restoreSpeed) * time.Second
-
-			fmt.Printf("  Restore time: ~%s\n", formatDuration(restoreTime))
-
-			// Validation time (10% of restore)
-			validationTime := restoreTime / 10
-			fmt.Printf("  Validation:   ~%s\n", formatDuration(validationTime))
-
-			// Total
-			totalTime := extractionTime + restoreTime + validationTime
-			fmt.Printf("  Total (RTO):  ~%s\n", formatDuration(totalTime))
-		}
-
-		fmt.Println()
-	}
-
-	// Validation status
-	fmt.Printf("Validation Status:\n")
-	if result.IsValid {
-		fmt.Printf("  Status:       ✓ VALID - Backup appears intact\n")
-	} else {
-		fmt.Printf("  Status:       ✗ INVALID - Backup has issues\n")
-	}
-
-	if result.IsTruncated {
-		fmt.Printf("  Truncation:   ✗ File appears truncated\n")
-	}
-	if result.IsCorrupted {
-		fmt.Printf("  Corruption:   ✗ Corruption detected\n")
-	}
-
-	if len(result.Errors) > 0 {
-		fmt.Printf("\n  Errors:\n")
-		for _, err := range result.Errors {
-			fmt.Printf("    - %s\n", err)
-		}
-	}
-
-	if len(result.Warnings) > 0 {
-		fmt.Printf("\n  Warnings:\n")
-		for _, warn := range result.Warnings {
-			fmt.Printf("    - %s\n", warn)
-		}
-	}
-	fmt.Println()
-
-	// Schema comparison
-	if previewCompareSchema {
-		fmt.Printf("Schema Comparison:\n")
-		fmt.Printf("  Status:       Not yet implemented\n")
-		fmt.Printf("                (Compare with current database schema)\n")
-		fmt.Println()
-	}
-
-	// Recommendations
-	fmt.Printf("Recommendations:\n")
-
-	if !result.IsValid {
-		fmt.Printf("  - ✗ DO NOT restore this backup - validation failed\n")
-		fmt.Printf("  - Run 'dbbackup restore diagnose %s' for detailed analysis\n", filepath.Base(archivePath))
-	} else {
-		fmt.Printf("  - ✓ Backup is valid and ready to restore\n")
-
-		// Resource recommendations
-		if result.Details != nil && result.Details.ExpandedSize > 0 {
-			estimatedRAM := result.Details.ExpandedSize / (1024 * 1024 * 1024) / 10 // Rough: 10% of data size
-			if estimatedRAM < 4 {
-				estimatedRAM = 4
-			}
-			fmt.Printf("  - Recommended RAM: %dGB or more\n", estimatedRAM)
-
-			// Disk space
-			estimatedDisk := int64(float64(result.Details.ExpandedSize) * 1.5)
-			fmt.Printf("  - Ensure %s free disk space\n", humanize.Bytes(uint64(estimatedDisk)))
-		}
-
-		// Profile recommendation
-		if result.Details != nil && result.Details.TableCount > 100 {
-			fmt.Printf("  - Use 'conservative' profile for databases with many tables\n")
-		} else {
-			fmt.Printf("  - Use 'turbo' profile for fastest restore\n")
-		}
-	}
-
-	fmt.Printf("\n%s\n", strings.Repeat("=", 70))
-
-	if result.IsValid {
-		fmt.Printf("Ready to restore? Run:\n")
-		if format.IsClusterBackup() {
-			fmt.Printf("  dbbackup restore cluster %s --confirm\n", filepath.Base(archivePath))
-		} else {
-			fmt.Printf("  dbbackup restore single %s --confirm\n", filepath.Base(archivePath))
-		}
-	} else {
-		fmt.Printf("Fix validation errors before attempting restore.\n")
-	}
-	fmt.Printf("%s\n\n", strings.Repeat("=", 70))
-
-	if !result.IsValid {
-		return fmt.Errorf("backup validation failed")
-	}
-
-	return nil
-}
-
-// Helper functions
-
-func extractDatabaseName(archivePath string, result *restore.DiagnoseResult) string {
-	// Try to extract from filename
-	baseName := filepath.Base(archivePath)
-	baseName = strings.TrimSuffix(baseName, ".gz")
-	baseName = strings.TrimSuffix(baseName, ".dump")
-	baseName = strings.TrimSuffix(baseName, ".sql")
-	baseName = strings.TrimSuffix(baseName, ".tar")
-
-	// Remove timestamp patterns
-	parts := strings.Split(baseName, "_")
-	if len(parts) > 0 {
-		return parts[0]
-	}
-
-	return "unknown"
-}
-
-func listDatabasesInCluster(archivePath string) ([]string, error) {
-	// This would extract and list databases from tar.gz
-	// For now, return empty to indicate it needs implementation
-	return nil, fmt.Errorf("not implemented")
-}

cmd/retention_simulator.go

@@ -1,486 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"path/filepath"
-	"sort"
-	"time"
-
-	"dbbackup/internal/metadata"
-	"dbbackup/internal/retention"
-
-	"github.com/spf13/cobra"
-)
-
-var retentionSimulatorCmd = &cobra.Command{
-	Use:   "retention-simulator",
-	Short: "Simulate retention policy effects",
-	Long: `Simulate and preview retention policy effects without deleting backups.
-
-The retention simulator helps you understand what would happen with
-different retention policies before applying them:
-  - Preview which backups would be deleted
-  - See which backups would be kept
-  - Understand space savings
-  - Test different retention strategies
-
-Supports multiple retention strategies:
-  - Simple age-based retention (days + min backups)
-  - GFS (Grandfather-Father-Son) retention
-  - Custom retention rules
-
-Examples:
-  # Simulate 30-day retention
-  dbbackup retention-simulator --days 30 --min-backups 5
-
-  # Simulate GFS retention
-  dbbackup retention-simulator --strategy gfs --daily 7 --weekly 4 --monthly 12
-
-  # Compare different strategies
-  dbbackup retention-simulator compare --days 30,60,90
-
-  # Show detailed simulation report
-  dbbackup retention-simulator --days 30 --format json`,
-}
-
-var retentionSimulatorCompareCmd = &cobra.Command{
-	Use:   "compare",
-	Short: "Compare multiple retention strategies",
-	Long:  `Compare effects of different retention policies side-by-side.`,
-	RunE:  runRetentionCompare,
-}
-
-var (
-	simRetentionDays int
-	simMinBackups    int
-	simStrategy      string
-	simFormat        string
-	simBackupDir     string
-	simGFSDaily      int
-	simGFSWeekly     int
-	simGFSMonthly    int
-	simGFSYearly     int
-	simCompareDays   []int
-)
-
-func init() {
-	rootCmd.AddCommand(retentionSimulatorCmd)
-
-	// Default command is simulate
-	retentionSimulatorCmd.RunE = runRetentionSimulator
-
-	retentionSimulatorCmd.AddCommand(retentionSimulatorCompareCmd)
-
-	retentionSimulatorCmd.Flags().IntVar(&simRetentionDays, "days", 30, "Retention period in days")
-	retentionSimulatorCmd.Flags().IntVar(&simMinBackups, "min-backups", 5, "Minimum backups to keep")
-	retentionSimulatorCmd.Flags().StringVar(&simStrategy, "strategy", "simple", "Retention strategy (simple, gfs)")
-	retentionSimulatorCmd.Flags().StringVar(&simFormat, "format", "text", "Output format (text, json)")
-	retentionSimulatorCmd.Flags().StringVar(&simBackupDir, "backup-dir", "", "Backup directory (default: from config)")
-
-	// GFS flags
-	retentionSimulatorCmd.Flags().IntVar(&simGFSDaily, "daily", 7, "GFS: Daily backups to keep")
-	retentionSimulatorCmd.Flags().IntVar(&simGFSWeekly, "weekly", 4, "GFS: Weekly backups to keep")
-	retentionSimulatorCmd.Flags().IntVar(&simGFSMonthly, "monthly", 12, "GFS: Monthly backups to keep")
-	retentionSimulatorCmd.Flags().IntVar(&simGFSYearly, "yearly", 5, "GFS: Yearly backups to keep")
-
-	retentionSimulatorCompareCmd.Flags().IntSliceVar(&simCompareDays, "days", []int{7, 14, 30, 60, 90}, "Retention days to compare")
-	retentionSimulatorCompareCmd.Flags().StringVar(&simBackupDir, "backup-dir", "", "Backup directory")
-	retentionSimulatorCompareCmd.Flags().IntVar(&simMinBackups, "min-backups", 5, "Minimum backups to keep")
-}
-
-func runRetentionSimulator(cmd *cobra.Command, args []string) error {
-	backupDir := simBackupDir
-	if backupDir == "" {
-		backupDir = cfg.BackupDir
-	}
-
-	fmt.Println("[RETENTION SIMULATOR]")
-	fmt.Println("==========================================")
-	fmt.Println()
-
-	// Load backups
-	backups, err := metadata.ListBackups(backupDir)
-	if err != nil {
-		return fmt.Errorf("failed to list backups: %w", err)
-	}
-
-	if len(backups) == 0 {
-		fmt.Println("No backups found in directory:", backupDir)
-		return nil
-	}
-
-	// Sort by timestamp (newest first for display)
-	sort.Slice(backups, func(i, j int) bool {
-		return backups[i].Timestamp.After(backups[j].Timestamp)
-	})
-
-	var simulation *SimulationResult
-
-	if simStrategy == "gfs" {
-		simulation = simulateGFSRetention(backups, simGFSDaily, simGFSWeekly, simGFSMonthly, simGFSYearly)
-	} else {
-		simulation = simulateSimpleRetention(backups, simRetentionDays, simMinBackups)
-	}
-
-	if simFormat == "json" {
-		data, _ := json.MarshalIndent(simulation, "", "  ")
-		fmt.Println(string(data))
-		return nil
-	}
-
-	printSimulationResults(simulation)
-	return nil
-}
-
-func runRetentionCompare(cmd *cobra.Command, args []string) error {
-	backupDir := simBackupDir
-	if backupDir == "" {
-		backupDir = cfg.BackupDir
-	}
-
-	fmt.Println("[RETENTION COMPARISON]")
-	fmt.Println("==========================================")
-	fmt.Println()
-
-	// Load backups
-	backups, err := metadata.ListBackups(backupDir)
-	if err != nil {
-		return fmt.Errorf("failed to list backups: %w", err)
-	}
-
-	if len(backups) == 0 {
-		fmt.Println("No backups found in directory:", backupDir)
-		return nil
-	}
-
-	fmt.Printf("Total backups: %d\n", len(backups))
-	fmt.Printf("Date range: %s to %s\n\n",
-		getOldestBackup(backups).Format("2006-01-02"),
-		getNewestBackup(backups).Format("2006-01-02"))
-
-	// Compare different retention periods
-	fmt.Println("Retention Policy Comparison:")
-	fmt.Println("─────────────────────────────────────────────────────────────")
-	fmt.Printf("%-12s %-12s %-12s %-15s\n", "Days", "Kept", "Deleted", "Space Saved")
-	fmt.Println("─────────────────────────────────────────────────────────────")
-
-	for _, days := range simCompareDays {
-		sim := simulateSimpleRetention(backups, days, simMinBackups)
-		fmt.Printf("%-12d %-12d %-12d %-15s\n",
-			days,
-			len(sim.KeptBackups),
-			len(sim.DeletedBackups),
-			formatRetentionBytes(sim.SpaceFreed))
-	}
-
-	fmt.Println("─────────────────────────────────────────────────────────────")
-	fmt.Println()
-
-	// Show recommendations
-	fmt.Println("[RECOMMENDATIONS]")
-	fmt.Println("==========================================")
-	fmt.Println()
-
-	totalSize := int64(0)
-	for _, b := range backups {
-		totalSize += b.SizeBytes
-	}
-
-	fmt.Println("Based on your backup history:")
-	fmt.Println()
-
-	// Calculate backup frequency
-	if len(backups) > 1 {
-		oldest := getOldestBackup(backups)
-		newest := getNewestBackup(backups)
-		duration := newest.Sub(oldest)
-		avgInterval := duration / time.Duration(len(backups)-1)
-
-		fmt.Printf("• Average backup interval: %s\n", formatRetentionDuration(avgInterval))
-		fmt.Printf("• Total storage used: %s\n", formatRetentionBytes(totalSize))
-		fmt.Println()
-
-		// Recommend based on frequency
-		if avgInterval < 24*time.Hour {
-			fmt.Println("✓ Recommended for daily backups:")
-			fmt.Println("  - Keep 7 days (weekly), min 5 backups")
-			fmt.Println("  - Or use GFS: --daily 7 --weekly 4 --monthly 6")
-		} else if avgInterval < 7*24*time.Hour {
-			fmt.Println("✓ Recommended for weekly backups:")
-			fmt.Println("  - Keep 30 days (monthly), min 4 backups")
-		} else {
-			fmt.Println("✓ Recommended for infrequent backups:")
-			fmt.Println("  - Keep 90+ days, min 3 backups")
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("Note: This is a simulation. No backups will be deleted.")
-	fmt.Println("Use 'dbbackup cleanup' to actually apply retention policy.")
-	fmt.Println()
-
-	return nil
-}
-
-type SimulationResult struct {
-	Strategy       string         `json:"strategy"`
-	TotalBackups   int            `json:"total_backups"`
-	KeptBackups    []BackupInfo   `json:"kept_backups"`
-	DeletedBackups []BackupInfo   `json:"deleted_backups"`
-	SpaceFreed     int64          `json:"space_freed"`
-	Parameters     map[string]int `json:"parameters"`
-}
-
-type BackupInfo struct {
-	Path      string    `json:"path"`
-	Database  string    `json:"database"`
-	Timestamp time.Time `json:"timestamp"`
-	Size      int64     `json:"size"`
-	Reason    string    `json:"reason,omitempty"`
-}
-
-func simulateSimpleRetention(backups []*metadata.BackupMetadata, days int, minBackups int) *SimulationResult {
-	result := &SimulationResult{
-		Strategy:       "simple",
-		TotalBackups:   len(backups),
-		KeptBackups:    []BackupInfo{},
-		DeletedBackups: []BackupInfo{},
-		Parameters: map[string]int{
-			"retention_days": days,
-			"min_backups":    minBackups,
-		},
-	}
-
-	// Sort by timestamp (oldest first for processing)
-	sorted := make([]*metadata.BackupMetadata, len(backups))
-	copy(sorted, backups)
-	sort.Slice(sorted, func(i, j int) bool {
-		return sorted[i].Timestamp.Before(sorted[j].Timestamp)
-	})
-
-	cutoffDate := time.Now().AddDate(0, 0, -days)
-
-	for i, backup := range sorted {
-		backupsRemaining := len(sorted) - i
-		info := BackupInfo{
-			Path:      filepath.Base(backup.BackupFile),
-			Database:  backup.Database,
-			Timestamp: backup.Timestamp,
-			Size:      backup.SizeBytes,
-		}
-
-		if backupsRemaining <= minBackups {
-			info.Reason = fmt.Sprintf("Protected (min %d backups)", minBackups)
-			result.KeptBackups = append(result.KeptBackups, info)
-		} else if backup.Timestamp.Before(cutoffDate) {
-			info.Reason = fmt.Sprintf("Older than %d days", days)
-			result.DeletedBackups = append(result.DeletedBackups, info)
-			result.SpaceFreed += backup.SizeBytes
-		} else {
-			info.Reason = fmt.Sprintf("Within %d days", days)
-			result.KeptBackups = append(result.KeptBackups, info)
-		}
-	}
-
-	return result
-}
-
-func simulateGFSRetention(backups []*metadata.BackupMetadata, daily, weekly, monthly, yearly int) *SimulationResult {
-	result := &SimulationResult{
-		Strategy:       "gfs",
-		TotalBackups:   len(backups),
-		KeptBackups:    []BackupInfo{},
-		DeletedBackups: []BackupInfo{},
-		Parameters: map[string]int{
-			"daily":   daily,
-			"weekly":  weekly,
-			"monthly": monthly,
-			"yearly":  yearly,
-		},
-	}
-
-	// Use GFS policy
-	policy := retention.GFSPolicy{
-		Daily:   daily,
-		Weekly:  weekly,
-		Monthly: monthly,
-		Yearly:  yearly,
-	}
-
-	gfsResult, err := retention.ApplyGFSPolicyToBackups(backups, policy)
-	if err != nil {
-		return result
-	}
-
-	// Convert to our format
-	for _, path := range gfsResult.Kept {
-		backup := findBackupByPath(backups, path)
-		if backup != nil {
-			result.KeptBackups = append(result.KeptBackups, BackupInfo{
-				Path:      filepath.Base(path),
-				Database:  backup.Database,
-				Timestamp: backup.Timestamp,
-				Size:      backup.SizeBytes,
-				Reason:    "GFS policy match",
-			})
-		}
-	}
-
-	for _, path := range gfsResult.Deleted {
-		backup := findBackupByPath(backups, path)
-		if backup != nil {
-			result.DeletedBackups = append(result.DeletedBackups, BackupInfo{
-				Path:      filepath.Base(path),
-				Database:  backup.Database,
-				Timestamp: backup.Timestamp,
-				Size:      backup.SizeBytes,
-				Reason:    "Not in GFS retention",
-			})
-			result.SpaceFreed += backup.SizeBytes
-		}
-	}
-
-	return result
-}
-
-func printSimulationResults(sim *SimulationResult) {
-	fmt.Printf("Strategy: %s\n", sim.Strategy)
-	fmt.Printf("Total Backups: %d\n", sim.TotalBackups)
-	fmt.Println()
-
-	fmt.Println("Parameters:")
-	for k, v := range sim.Parameters {
-		fmt.Printf("  %s: %d\n", k, v)
-	}
-	fmt.Println()
-
-	fmt.Printf("✓ Backups to Keep: %d\n", len(sim.KeptBackups))
-	fmt.Printf("✗ Backups to Delete: %d\n", len(sim.DeletedBackups))
-	fmt.Printf("💾 Space to Free: %s\n", formatRetentionBytes(sim.SpaceFreed))
-	fmt.Println()
-
-	if len(sim.DeletedBackups) > 0 {
-		fmt.Println("[BACKUPS TO DELETE]")
-		fmt.Println("──────────────────────────────────────────────────────────────────")
-		fmt.Printf("%-22s %-20s %-12s %s\n", "Date", "Database", "Size", "Reason")
-		fmt.Println("──────────────────────────────────────────────────────────────────")
-
-		// Sort deleted by timestamp
-		sort.Slice(sim.DeletedBackups, func(i, j int) bool {
-			return sim.DeletedBackups[i].Timestamp.Before(sim.DeletedBackups[j].Timestamp)
-		})
-
-		for _, b := range sim.DeletedBackups {
-			fmt.Printf("%-22s %-20s %-12s %s\n",
-				b.Timestamp.Format("2006-01-02 15:04:05"),
-				truncateRetentionString(b.Database, 18),
-				formatRetentionBytes(b.Size),
-				b.Reason)
-		}
-		fmt.Println()
-	}
-
-	if len(sim.KeptBackups) > 0 {
-		fmt.Println("[BACKUPS TO KEEP]")
-		fmt.Println("──────────────────────────────────────────────────────────────────")
-		fmt.Printf("%-22s %-20s %-12s %s\n", "Date", "Database", "Size", "Reason")
-		fmt.Println("──────────────────────────────────────────────────────────────────")
-
-		// Sort kept by timestamp (newest first)
-		sort.Slice(sim.KeptBackups, func(i, j int) bool {
-			return sim.KeptBackups[i].Timestamp.After(sim.KeptBackups[j].Timestamp)
-		})
-
-		// Show only first 10 to avoid clutter
-		limit := 10
-		if len(sim.KeptBackups) < limit {
-			limit = len(sim.KeptBackups)
-		}
-
-		for i := 0; i < limit; i++ {
-			b := sim.KeptBackups[i]
-			fmt.Printf("%-22s %-20s %-12s %s\n",
-				b.Timestamp.Format("2006-01-02 15:04:05"),
-				truncateRetentionString(b.Database, 18),
-				formatRetentionBytes(b.Size),
-				b.Reason)
-		}
-
-		if len(sim.KeptBackups) > limit {
-			fmt.Printf("... and %d more\n", len(sim.KeptBackups)-limit)
-		}
-		fmt.Println()
-	}
-
-	fmt.Println("[NOTE]")
-	fmt.Println("──────────────────────────────────────────────────────────────────")
-	fmt.Println("This is a simulation. No backups have been deleted.")
-	fmt.Println("To apply this policy, use: dbbackup cleanup --confirm")
-	fmt.Println()
-}
-
-func findBackupByPath(backups []*metadata.BackupMetadata, path string) *metadata.BackupMetadata {
-	for _, b := range backups {
-		if b.BackupFile == path {
-			return b
-		}
-	}
-	return nil
-}
-
-func getOldestBackup(backups []*metadata.BackupMetadata) time.Time {
-	if len(backups) == 0 {
-		return time.Now()
-	}
-	oldest := backups[0].Timestamp
-	for _, b := range backups {
-		if b.Timestamp.Before(oldest) {
-			oldest = b.Timestamp
-		}
-	}
-	return oldest
-}
-
-func getNewestBackup(backups []*metadata.BackupMetadata) time.Time {
-	if len(backups) == 0 {
-		return time.Now()
-	}
-	newest := backups[0].Timestamp
-	for _, b := range backups {
-		if b.Timestamp.After(newest) {
-			newest = b.Timestamp
-		}
-	}
-	return newest
-}
-
-func formatRetentionBytes(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}
-
-func formatRetentionDuration(d time.Duration) string {
-	if d < time.Hour {
-		return fmt.Sprintf("%.0f minutes", d.Minutes())
-	}
-	if d < 24*time.Hour {
-		return fmt.Sprintf("%.1f hours", d.Hours())
-	}
-	return fmt.Sprintf("%.1f days", d.Hours()/24)
-}
-
-func truncateRetentionString(s string, maxLen int) string {
-	if len(s) <= maxLen {
-		return s
-	}
-	return s[:maxLen-3] + "..."
-}

cmd/root.go

@@ -3,11 +3,9 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"dbbackup/internal/config"
 	"dbbackup/internal/logger"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/security"
 
 	"github.com/spf13/cobra"
@@ -15,11 +13,10 @@ import (
 )
 
 var (
-	cfg           *config.Config
-	log           logger.Logger
-	auditLogger   *security.AuditLogger
-	rateLimiter   *security.RateLimiter
-	notifyManager *notify.Manager
+	cfg         *config.Config
+	log         logger.Logger
+	auditLogger *security.AuditLogger
+	rateLimiter *security.RateLimiter
 )
 
 // rootCmd represents the base command when called without any subcommands
@@ -55,26 +52,9 @@ For help with specific commands, use: dbbackup [command] --help`,
 
 		// Load local config if not disabled
 		if !cfg.NoLoadConfig {
-			// Use custom config path if specified, otherwise default to current directory
-			var localCfg *config.LocalConfig
-			var err error
-			if cfg.ConfigPath != "" {
-				localCfg, err = config.LoadLocalConfigFromPath(cfg.ConfigPath)
-				if err != nil {
-					log.Warn("Failed to load config from specified path", "path", cfg.ConfigPath, "error", err)
-				} else if localCfg != nil {
-					log.Info("Loaded configuration", "path", cfg.ConfigPath)
-				}
-			} else {
-				localCfg, err = config.LoadLocalConfig()
-				if err != nil {
-					log.Warn("Failed to load local config", "error", err)
-				} else if localCfg != nil {
-					log.Info("Loaded configuration from .dbbackup.conf")
-				}
-			}
-
-			if localCfg != nil {
+			if localCfg, err := config.LoadLocalConfig(); err != nil {
+				log.Warn("Failed to load local config", "error", err)
+			} else if localCfg != nil {
 				// Save current flag values that were explicitly set
 				savedBackupDir := cfg.BackupDir
 				savedHost := cfg.Host
@@ -89,6 +69,7 @@ For help with specific commands, use: dbbackup [command] --help`,
 
 				// Apply config from file
 				config.ApplyLocalConfig(cfg, localCfg)
+				log.Info("Loaded configuration from .dbbackup.conf")
 
 				// Restore explicitly set flag values (flags have priority)
 				if flagsSet["backup-dir"] {
@@ -124,18 +105,6 @@ For help with specific commands, use: dbbackup [command] --help`,
 			}
 		}
 
-		// Auto-detect socket from --host path (if host starts with /)
-		// For MySQL/MariaDB: set Socket and reset Host to localhost
-		// For PostgreSQL: keep Host as socket path (pgx/libpq handle it correctly)
-		if strings.HasPrefix(cfg.Host, "/") && cfg.Socket == "" {
-			if cfg.IsMySQL() {
-				// MySQL uses separate Socket field, Host should be localhost
-				cfg.Socket = cfg.Host
-				cfg.Host = "localhost"
-			}
-			// For PostgreSQL, keep cfg.Host as the socket path - pgx handles this correctly
-		}
-
 		return cfg.SetDatabaseType(cfg.DatabaseType)
 	},
 }
@@ -151,40 +120,20 @@ func Execute(ctx context.Context, config *config.Config, logger logger.Logger) e
 	// Initialize rate limiter
 	rateLimiter = security.NewRateLimiter(config.MaxRetries, logger)
 
-	// Initialize notification manager from environment variables
-	notifyCfg := notify.ConfigFromEnv()
-	notifyManager = notify.NewManager(notifyCfg)
-	if notifyManager.HasEnabledNotifiers() {
-		logger.Info("Notifications enabled", "smtp", notifyCfg.SMTPEnabled, "webhook", notifyCfg.WebhookEnabled)
-	}
-
 	// Set version info
 	rootCmd.Version = fmt.Sprintf("%s (built: %s, commit: %s)",
 		cfg.Version, cfg.BuildTime, cfg.GitCommit)
 
 	// Add persistent flags
-	rootCmd.PersistentFlags().StringVarP(&cfg.ConfigPath, "config", "c", "", "Path to config file (default: .dbbackup.conf in current directory)")
 	rootCmd.PersistentFlags().StringVar(&cfg.Host, "host", cfg.Host, "Database host")
 	rootCmd.PersistentFlags().IntVar(&cfg.Port, "port", cfg.Port, "Database port")
-	rootCmd.PersistentFlags().StringVar(&cfg.Socket, "socket", cfg.Socket, "Unix socket path for MySQL/MariaDB (e.g., /var/run/mysqld/mysqld.sock)")
 	rootCmd.PersistentFlags().StringVar(&cfg.User, "user", cfg.User, "Database user")
 	rootCmd.PersistentFlags().StringVar(&cfg.Database, "database", cfg.Database, "Database name")
-	// SECURITY: Password flag removed - use PGPASSWORD/MYSQL_PWD environment variable or .pgpass file
-	// Provide helpful error message for users expecting --password flag
-	var deprecatedPassword string
-	rootCmd.PersistentFlags().StringVar(&deprecatedPassword, "password", "", "DEPRECATED: Use MYSQL_PWD or PGPASSWORD environment variable instead")
-	rootCmd.PersistentFlags().MarkHidden("password")
-	rootCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
-		if deprecatedPassword != "" {
-			return fmt.Errorf("--password flag is not supported for security reasons. Use environment variables instead:\n  - MySQL/MariaDB: export MYSQL_PWD='your_password'\n  - PostgreSQL: export PGPASSWORD='your_password' or use .pgpass file")
-		}
-		return nil
-	}
+	rootCmd.PersistentFlags().StringVar(&cfg.Password, "password", cfg.Password, "Database password")
 	rootCmd.PersistentFlags().StringVarP(&cfg.DatabaseType, "db-type", "d", cfg.DatabaseType, "Database type (postgres|mysql|mariadb)")
 	rootCmd.PersistentFlags().StringVar(&cfg.BackupDir, "backup-dir", cfg.BackupDir, "Backup directory")
 	rootCmd.PersistentFlags().BoolVar(&cfg.NoColor, "no-color", cfg.NoColor, "Disable colored output")
 	rootCmd.PersistentFlags().BoolVar(&cfg.Debug, "debug", cfg.Debug, "Enable debug logging")
-	rootCmd.PersistentFlags().BoolVar(&cfg.DebugLocks, "debug-locks", cfg.DebugLocks, "Enable detailed lock debugging (captures PostgreSQL lock configuration, Large DB Guard decisions, boost attempts)")
 	rootCmd.PersistentFlags().IntVar(&cfg.Jobs, "jobs", cfg.Jobs, "Number of parallel jobs")
 	rootCmd.PersistentFlags().IntVar(&cfg.DumpJobs, "dump-jobs", cfg.DumpJobs, "Number of parallel dump jobs")
 	rootCmd.PersistentFlags().IntVar(&cfg.MaxCores, "max-cores", cfg.MaxCores, "Maximum CPU cores to use")
@@ -196,11 +145,6 @@ func Execute(ctx context.Context, config *config.Config, logger logger.Logger) e
 	rootCmd.PersistentFlags().BoolVar(&cfg.NoSaveConfig, "no-save-config", false, "Don't save configuration after successful operations")
 	rootCmd.PersistentFlags().BoolVar(&cfg.NoLoadConfig, "no-config", false, "Don't load configuration from .dbbackup.conf")
 
-	// Native engine flags
-	rootCmd.PersistentFlags().BoolVar(&cfg.UseNativeEngine, "native", cfg.UseNativeEngine, "Use pure Go native engines (no external tools)")
-	rootCmd.PersistentFlags().BoolVar(&cfg.FallbackToTools, "fallback-tools", cfg.FallbackToTools, "Fallback to external tools if native engine fails")
-	rootCmd.PersistentFlags().BoolVar(&cfg.NativeEngineDebug, "native-debug", cfg.NativeEngineDebug, "Enable detailed native engine debugging")
-
 	// Security flags (MEDIUM priority)
 	rootCmd.PersistentFlags().IntVar(&cfg.RetentionDays, "retention-days", cfg.RetentionDays, "Backup retention period in days (0=disabled)")
 	rootCmd.PersistentFlags().IntVar(&cfg.MinBackups, "min-backups", cfg.MinBackups, "Minimum number of backups to keep")

cmd/schedule.go

@@ -1,275 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/spf13/cobra"
-)
-
-var scheduleFormat string
-
-var scheduleCmd = &cobra.Command{
-	Use:   "schedule",
-	Short: "Show scheduled backup times",
-	Long: `Display information about scheduled backups from systemd timers.
-
-This command queries systemd to show:
-  - Next scheduled backup time
-  - Last run time and duration
-  - Timer status (active/inactive)
-  - Calendar schedule configuration
-
-Useful for:
-  - Verifying backup schedules
-  - Troubleshooting missed backups
-  - Planning maintenance windows
-
-Examples:
-  # Show all backup schedules
-  dbbackup schedule
-
-  # JSON output for automation
-  dbbackup schedule --format json
-
-  # Show specific timer
-  dbbackup schedule --timer dbbackup-databases`,
-	RunE: runSchedule,
-}
-
-var (
-	scheduleTimer string
-	scheduleAll   bool
-)
-
-func init() {
-	rootCmd.AddCommand(scheduleCmd)
-	scheduleCmd.Flags().StringVar(&scheduleFormat, "format", "table", "Output format (table, json)")
-	scheduleCmd.Flags().StringVar(&scheduleTimer, "timer", "", "Show specific timer only")
-	scheduleCmd.Flags().BoolVar(&scheduleAll, "all", false, "Show all timers (not just dbbackup)")
-}
-
-type TimerInfo struct {
-	Name        string    `json:"name"`
-	Description string    `json:"description,omitempty"`
-	NextRun     string    `json:"next_run"`
-	NextRunTime time.Time `json:"next_run_time,omitempty"`
-	LastRun     string    `json:"last_run,omitempty"`
-	LastRunTime time.Time `json:"last_run_time,omitempty"`
-	Passed      string    `json:"passed,omitempty"`
-	Left        string    `json:"left,omitempty"`
-	Active      string    `json:"active"`
-	Unit        string    `json:"unit,omitempty"`
-}
-
-func runSchedule(cmd *cobra.Command, args []string) error {
-	// Check if systemd is available
-	if runtime.GOOS == "windows" {
-		return fmt.Errorf("schedule command is only supported on Linux with systemd")
-	}
-
-	// Check if systemctl is available
-	if _, err := exec.LookPath("systemctl"); err != nil {
-		return fmt.Errorf("systemctl not found - this command requires systemd")
-	}
-
-	timers, err := getSystemdTimers()
-	if err != nil {
-		return err
-	}
-
-	// Filter timers
-	filtered := filterTimers(timers)
-
-	if len(filtered) == 0 {
-		fmt.Println("No backup timers found.")
-		fmt.Println("\nTo install dbbackup as a systemd service:")
-		fmt.Println("  sudo dbbackup install")
-		return nil
-	}
-
-	// Output based on format
-	if scheduleFormat == "json" {
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(filtered)
-	}
-
-	// Table format
-	outputTimerTable(filtered)
-	return nil
-}
-
-func getSystemdTimers() ([]TimerInfo, error) {
-	// Run systemctl list-timers --all --no-pager
-	cmdArgs := []string{"list-timers", "--all", "--no-pager"}
-
-	output, err := exec.Command("systemctl", cmdArgs...).CombinedOutput()
-	if err != nil {
-		return nil, fmt.Errorf("failed to list timers: %w\nOutput: %s", err, string(output))
-	}
-
-	return parseTimerList(string(output)), nil
-}
-
-func parseTimerList(output string) []TimerInfo {
-	var timers []TimerInfo
-	lines := strings.Split(output, "\n")
-
-	// Skip header and footer
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "NEXT") || strings.HasPrefix(line, "---") {
-			continue
-		}
-
-		// Parse timer line format:
-		// NEXT                        LEFT          LAST                        PASSED       UNIT                         ACTIVATES
-		fields := strings.Fields(line)
-		if len(fields) < 5 {
-			continue
-		}
-
-		// Extract timer info
-		timer := TimerInfo{}
-
-		// Check if NEXT field is "n/a" (inactive timer)
-		if fields[0] == "n/a" {
-			timer.NextRun = "n/a"
-			timer.Left = "n/a"
-			// Shift indices
-			if len(fields) >= 3 {
-				timer.Unit = fields[len(fields)-2]
-				timer.Active = "inactive"
-			}
-		} else {
-			// Active timer - parse dates
-			nextIdx := 0
-			unitIdx := -1
-
-			// Find indices by looking for recognizable patterns
-			for i, field := range fields {
-				if strings.Contains(field, ":") && nextIdx == 0 {
-					nextIdx = i
-				} else if strings.HasSuffix(field, ".timer") || strings.HasSuffix(field, ".service") {
-					unitIdx = i
-				}
-			}
-
-			// Build timer info
-			if nextIdx > 0 {
-				// Combine date and time for NEXT
-				timer.NextRun = strings.Join(fields[0:nextIdx+1], " ")
-			}
-
-			// Find LEFT (time until next)
-			var leftIdx int
-			for i := nextIdx + 1; i < len(fields); i++ {
-				if fields[i] == "left" {
-					if i > 0 {
-						timer.Left = strings.Join(fields[nextIdx+1:i], " ")
-					}
-					leftIdx = i
-					break
-				}
-			}
-
-			// Find LAST (last run time)
-			if leftIdx > 0 {
-				for i := leftIdx + 1; i < len(fields); i++ {
-					if fields[i] == "ago" {
-						timer.LastRun = strings.Join(fields[leftIdx+1:i+1], " ")
-						break
-					}
-				}
-			}
-
-			// Unit is usually second to last
-			if unitIdx > 0 {
-				timer.Unit = fields[unitIdx]
-			} else if len(fields) >= 2 {
-				timer.Unit = fields[len(fields)-2]
-			}
-
-			timer.Active = "active"
-		}
-
-		if timer.Unit != "" {
-			timers = append(timers, timer)
-		}
-	}
-
-	return timers
-}
-
-func filterTimers(timers []TimerInfo) []TimerInfo {
-	var filtered []TimerInfo
-
-	for _, timer := range timers {
-		// If specific timer requested
-		if scheduleTimer != "" {
-			if strings.Contains(timer.Unit, scheduleTimer) {
-				filtered = append(filtered, timer)
-			}
-			continue
-		}
-
-		// If --all flag, return all
-		if scheduleAll {
-			filtered = append(filtered, timer)
-			continue
-		}
-
-		// Default: filter for backup-related timers
-		name := strings.ToLower(timer.Unit)
-		if strings.Contains(name, "backup") ||
-			strings.Contains(name, "dbbackup") ||
-			strings.Contains(name, "postgres") ||
-			strings.Contains(name, "mysql") ||
-			strings.Contains(name, "mariadb") {
-			filtered = append(filtered, timer)
-		}
-	}
-
-	return filtered
-}
-
-func outputTimerTable(timers []TimerInfo) {
-	fmt.Println()
-	fmt.Println("Scheduled Backups")
-	fmt.Println("=====================================================")
-
-	for _, timer := range timers {
-		name := strings.TrimSuffix(timer.Unit, ".timer")
-
-		fmt.Printf("\n[TIMER] %s\n", name)
-		fmt.Printf("  Status:     %s\n", timer.Active)
-
-		if timer.Active == "active" && timer.NextRun != "" && timer.NextRun != "n/a" {
-			fmt.Printf("  Next Run:   %s\n", timer.NextRun)
-			if timer.Left != "" {
-				fmt.Printf("  Due In:     %s\n", timer.Left)
-			}
-		} else {
-			fmt.Printf("  Next Run:   Not scheduled (timer inactive)\n")
-		}
-
-		if timer.LastRun != "" && timer.LastRun != "n/a" {
-			fmt.Printf("  Last Run:   %s\n", timer.LastRun)
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("=====================================================")
-	fmt.Printf("Total: %d timer(s)\n", len(timers))
-	fmt.Println()
-
-	if !scheduleAll {
-		fmt.Println("Tip: Use --all to show all system timers")
-	}
-}

cmd/validate.go

@@ -1,540 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"dbbackup/internal/config"
-
-	"github.com/spf13/cobra"
-)
-
-var validateCmd = &cobra.Command{
-	Use:   "validate",
-	Short: "Validate configuration and environment",
-	Long: `Validate dbbackup configuration file and runtime environment.
-
-This command performs comprehensive validation:
-  - Configuration file syntax and structure
-  - Database connection parameters
-  - Directory paths and permissions
-  - External tool availability (pg_dump, mysqldump)
-  - Cloud storage credentials (if configured)
-  - Encryption setup (if enabled)
-  - Resource limits and system requirements
-  - Port accessibility
-
-Helps identify configuration issues before running backups.
-
-Examples:
-  # Validate default config (.dbbackup.conf)
-  dbbackup validate
-
-  # Validate specific config file
-  dbbackup validate --config /etc/dbbackup/prod.conf
-
-  # Quick validation (skip connectivity tests)
-  dbbackup validate --quick
-
-  # JSON output for automation
-  dbbackup validate --format json`,
-	RunE: runValidate,
-}
-
-var (
-	validateFormat string
-	validateQuick  bool
-)
-
-type ValidationResult struct {
-	Valid    bool              `json:"valid"`
-	Issues   []ValidationIssue `json:"issues"`
-	Warnings []ValidationIssue `json:"warnings"`
-	Checks   []ValidationCheck `json:"checks"`
-	Summary  string            `json:"summary"`
-}
-
-type ValidationIssue struct {
-	Category    string `json:"category"`
-	Description string `json:"description"`
-	Suggestion  string `json:"suggestion,omitempty"`
-}
-
-type ValidationCheck struct {
-	Name    string `json:"name"`
-	Status  string `json:"status"` // "pass", "warn", "fail"
-	Message string `json:"message,omitempty"`
-}
-
-func init() {
-	rootCmd.AddCommand(validateCmd)
-
-	validateCmd.Flags().StringVar(&validateFormat, "format", "table", "Output format (table, json)")
-	validateCmd.Flags().BoolVar(&validateQuick, "quick", false, "Quick validation (skip connectivity tests)")
-}
-
-func runValidate(cmd *cobra.Command, args []string) error {
-	result := &ValidationResult{
-		Valid:    true,
-		Issues:   []ValidationIssue{},
-		Warnings: []ValidationIssue{},
-		Checks:   []ValidationCheck{},
-	}
-
-	// Validate configuration file
-	validateConfigFile(cfg, result)
-
-	// Validate database settings
-	validateDatabase(cfg, result)
-
-	// Validate paths
-	validatePaths(cfg, result)
-
-	// Validate external tools
-	validateTools(cfg, result)
-
-	// Validate cloud storage (if enabled)
-	if cfg.CloudEnabled {
-		validateCloud(cfg, result)
-	}
-
-	// Validate encryption (if enabled)
-	if cfg.PITREnabled && cfg.WALEncryption {
-		validateEncryption(cfg, result)
-	}
-
-	// Validate resource limits
-	validateResources(cfg, result)
-
-	// Connectivity tests (unless --quick)
-	if !validateQuick {
-		validateConnectivity(cfg, result)
-	}
-
-	// Determine overall validity
-	result.Valid = len(result.Issues) == 0
-
-	// Generate summary
-	if result.Valid {
-		if len(result.Warnings) > 0 {
-			result.Summary = fmt.Sprintf("Configuration valid with %d warning(s)", len(result.Warnings))
-		} else {
-			result.Summary = "Configuration valid - all checks passed"
-		}
-	} else {
-		result.Summary = fmt.Sprintf("Configuration invalid - %d issue(s) found", len(result.Issues))
-	}
-
-	// Output results
-	if validateFormat == "json" {
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(result)
-	}
-
-	printValidationResult(result)
-
-	if !result.Valid {
-		return fmt.Errorf("validation failed")
-	}
-
-	return nil
-}
-
-func validateConfigFile(cfg *config.Config, result *ValidationResult) {
-	check := ValidationCheck{Name: "Configuration File"}
-
-	if cfg.ConfigPath == "" {
-		check.Status = "warn"
-		check.Message = "No config file specified (using defaults)"
-		result.Warnings = append(result.Warnings, ValidationIssue{
-			Category:    "config",
-			Description: "No configuration file found",
-			Suggestion:  "Run 'dbbackup backup' to create .dbbackup.conf",
-		})
-	} else {
-		if _, err := os.Stat(cfg.ConfigPath); err != nil {
-			check.Status = "warn"
-			check.Message = "Config file not found"
-			result.Warnings = append(result.Warnings, ValidationIssue{
-				Category:    "config",
-				Description: fmt.Sprintf("Config file not accessible: %s", cfg.ConfigPath),
-				Suggestion:  "Check file path and permissions",
-			})
-		} else {
-			check.Status = "pass"
-			check.Message = fmt.Sprintf("Loaded from %s", cfg.ConfigPath)
-		}
-	}
-
-	result.Checks = append(result.Checks, check)
-}
-
-func validateDatabase(cfg *config.Config, result *ValidationResult) {
-	// Database type
-	check := ValidationCheck{Name: "Database Type"}
-	if cfg.DatabaseType != "postgres" && cfg.DatabaseType != "mysql" && cfg.DatabaseType != "mariadb" {
-		check.Status = "fail"
-		check.Message = fmt.Sprintf("Invalid: %s", cfg.DatabaseType)
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "database",
-			Description: fmt.Sprintf("Invalid database type: %s", cfg.DatabaseType),
-			Suggestion:  "Use 'postgres', 'mysql', or 'mariadb'",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = cfg.DatabaseType
-	}
-	result.Checks = append(result.Checks, check)
-
-	// Host
-	check = ValidationCheck{Name: "Database Host"}
-	if cfg.Host == "" {
-		check.Status = "fail"
-		check.Message = "Not configured"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "database",
-			Description: "Database host not specified",
-			Suggestion:  "Set --host flag or host in config file",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = cfg.Host
-	}
-	result.Checks = append(result.Checks, check)
-
-	// Port
-	check = ValidationCheck{Name: "Database Port"}
-	if cfg.Port <= 0 || cfg.Port > 65535 {
-		check.Status = "fail"
-		check.Message = fmt.Sprintf("Invalid: %d", cfg.Port)
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "database",
-			Description: fmt.Sprintf("Invalid port number: %d", cfg.Port),
-			Suggestion:  "Use valid port (1-65535)",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = strconv.Itoa(cfg.Port)
-	}
-	result.Checks = append(result.Checks, check)
-
-	// User
-	check = ValidationCheck{Name: "Database User"}
-	if cfg.User == "" {
-		check.Status = "warn"
-		check.Message = "Not configured (using current user)"
-		result.Warnings = append(result.Warnings, ValidationIssue{
-			Category:    "database",
-			Description: "Database user not specified",
-			Suggestion:  "Set --user flag or user in config file",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = cfg.User
-	}
-	result.Checks = append(result.Checks, check)
-}
-
-func validatePaths(cfg *config.Config, result *ValidationResult) {
-	// Backup directory
-	check := ValidationCheck{Name: "Backup Directory"}
-	if cfg.BackupDir == "" {
-		check.Status = "fail"
-		check.Message = "Not configured"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "paths",
-			Description: "Backup directory not specified",
-			Suggestion:  "Set --backup-dir flag or backup_dir in config",
-		})
-	} else {
-		info, err := os.Stat(cfg.BackupDir)
-		if err != nil {
-			check.Status = "warn"
-			check.Message = "Does not exist (will be created)"
-			result.Warnings = append(result.Warnings, ValidationIssue{
-				Category:    "paths",
-				Description: fmt.Sprintf("Backup directory does not exist: %s", cfg.BackupDir),
-				Suggestion:  "Directory will be created automatically",
-			})
-		} else if !info.IsDir() {
-			check.Status = "fail"
-			check.Message = "Not a directory"
-			result.Issues = append(result.Issues, ValidationIssue{
-				Category:    "paths",
-				Description: fmt.Sprintf("Backup path is not a directory: %s", cfg.BackupDir),
-				Suggestion:  "Specify a valid directory path",
-			})
-		} else {
-			// Check write permissions
-			testFile := filepath.Join(cfg.BackupDir, ".dbbackup-test")
-			if err := os.WriteFile(testFile, []byte("test"), 0644); err != nil {
-				check.Status = "fail"
-				check.Message = "Not writable"
-				result.Issues = append(result.Issues, ValidationIssue{
-					Category:    "paths",
-					Description: fmt.Sprintf("Cannot write to backup directory: %s", cfg.BackupDir),
-					Suggestion:  "Check directory permissions",
-				})
-			} else {
-				os.Remove(testFile)
-				check.Status = "pass"
-				check.Message = cfg.BackupDir
-			}
-		}
-	}
-	result.Checks = append(result.Checks, check)
-
-	// WAL archive directory (if PITR enabled)
-	if cfg.PITREnabled {
-		check = ValidationCheck{Name: "WAL Archive Directory"}
-		if cfg.WALArchiveDir == "" {
-			check.Status = "warn"
-			check.Message = "Not configured"
-			result.Warnings = append(result.Warnings, ValidationIssue{
-				Category:    "pitr",
-				Description: "PITR enabled but WAL archive directory not set",
-				Suggestion:  "Set --wal-archive-dir for PITR functionality",
-			})
-		} else {
-			check.Status = "pass"
-			check.Message = cfg.WALArchiveDir
-		}
-		result.Checks = append(result.Checks, check)
-	}
-}
-
-func validateTools(cfg *config.Config, result *ValidationResult) {
-	// Skip if using native engine
-	if cfg.UseNativeEngine {
-		check := ValidationCheck{
-			Name:    "External Tools",
-			Status:  "pass",
-			Message: "Using native Go engine (no external tools required)",
-		}
-		result.Checks = append(result.Checks, check)
-		return
-	}
-
-	// Check for database tools
-	var requiredTools []string
-	if cfg.DatabaseType == "postgres" {
-		requiredTools = []string{"pg_dump", "pg_restore", "psql"}
-	} else if cfg.DatabaseType == "mysql" || cfg.DatabaseType == "mariadb" {
-		requiredTools = []string{"mysqldump", "mysql"}
-	}
-
-	for _, tool := range requiredTools {
-		check := ValidationCheck{Name: fmt.Sprintf("Tool: %s", tool)}
-		path, err := exec.LookPath(tool)
-		if err != nil {
-			check.Status = "fail"
-			check.Message = "Not found in PATH"
-			result.Issues = append(result.Issues, ValidationIssue{
-				Category:    "tools",
-				Description: fmt.Sprintf("Required tool not found: %s", tool),
-				Suggestion:  fmt.Sprintf("Install %s or use --native flag", tool),
-			})
-		} else {
-			check.Status = "pass"
-			check.Message = path
-		}
-		result.Checks = append(result.Checks, check)
-	}
-}
-
-func validateCloud(cfg *config.Config, result *ValidationResult) {
-	check := ValidationCheck{Name: "Cloud Storage"}
-
-	if cfg.CloudProvider == "" {
-		check.Status = "fail"
-		check.Message = "Provider not configured"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "cloud",
-			Description: "Cloud enabled but provider not specified",
-			Suggestion:  "Set --cloud-provider (s3, gcs, azure, minio, b2)",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = cfg.CloudProvider
-	}
-	result.Checks = append(result.Checks, check)
-
-	// Bucket
-	check = ValidationCheck{Name: "Cloud Bucket"}
-	if cfg.CloudBucket == "" {
-		check.Status = "fail"
-		check.Message = "Not configured"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "cloud",
-			Description: "Cloud bucket/container not specified",
-			Suggestion:  "Set --cloud-bucket",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = cfg.CloudBucket
-	}
-	result.Checks = append(result.Checks, check)
-
-	// Credentials
-	check = ValidationCheck{Name: "Cloud Credentials"}
-	if cfg.CloudAccessKey == "" || cfg.CloudSecretKey == "" {
-		check.Status = "warn"
-		check.Message = "Credentials not in config (may use env vars)"
-		result.Warnings = append(result.Warnings, ValidationIssue{
-			Category:    "cloud",
-			Description: "Cloud credentials not in config file",
-			Suggestion:  "Ensure AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or similar env vars are set",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = "Configured"
-	}
-	result.Checks = append(result.Checks, check)
-}
-
-func validateEncryption(cfg *config.Config, result *ValidationResult) {
-	check := ValidationCheck{Name: "Encryption"}
-
-	// Check for openssl
-	if _, err := exec.LookPath("openssl"); err != nil {
-		check.Status = "fail"
-		check.Message = "openssl not found"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "encryption",
-			Description: "Encryption enabled but openssl not available",
-			Suggestion:  "Install openssl or disable WAL encryption",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = "openssl available"
-	}
-
-	result.Checks = append(result.Checks, check)
-}
-
-func validateResources(cfg *config.Config, result *ValidationResult) {
-	// CPU cores
-	check := ValidationCheck{Name: "CPU Cores"}
-	if cfg.MaxCores < 1 {
-		check.Status = "fail"
-		check.Message = "Invalid core count"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "resources",
-			Description: "Invalid max cores setting",
-			Suggestion:  "Set --max-cores to positive value",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = fmt.Sprintf("%d cores", cfg.MaxCores)
-	}
-	result.Checks = append(result.Checks, check)
-
-	// Jobs
-	check = ValidationCheck{Name: "Parallel Jobs"}
-	if cfg.Jobs < 1 {
-		check.Status = "fail"
-		check.Message = "Invalid job count"
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "resources",
-			Description: "Invalid jobs setting",
-			Suggestion:  "Set --jobs to positive value",
-		})
-	} else if cfg.Jobs > cfg.MaxCores*2 {
-		check.Status = "warn"
-		check.Message = fmt.Sprintf("%d jobs (high)", cfg.Jobs)
-		result.Warnings = append(result.Warnings, ValidationIssue{
-			Category:    "resources",
-			Description: "Jobs count higher than CPU cores",
-			Suggestion:  "Consider reducing --jobs for better performance",
-		})
-	} else {
-		check.Status = "pass"
-		check.Message = fmt.Sprintf("%d jobs", cfg.Jobs)
-	}
-	result.Checks = append(result.Checks, check)
-}
-
-func validateConnectivity(cfg *config.Config, result *ValidationResult) {
-	check := ValidationCheck{Name: "Database Connectivity"}
-
-	// Try to connect to database port
-	address := net.JoinHostPort(cfg.Host, strconv.Itoa(cfg.Port))
-	conn, err := net.DialTimeout("tcp", address, 5*1000000000) // 5 seconds
-	if err != nil {
-		check.Status = "fail"
-		check.Message = fmt.Sprintf("Cannot connect to %s", address)
-		result.Issues = append(result.Issues, ValidationIssue{
-			Category:    "connectivity",
-			Description: fmt.Sprintf("Cannot connect to database: %v", err),
-			Suggestion:  "Check host, port, and network connectivity",
-		})
-	} else {
-		conn.Close()
-		check.Status = "pass"
-		check.Message = fmt.Sprintf("Connected to %s", address)
-	}
-
-	result.Checks = append(result.Checks, check)
-}
-
-func printValidationResult(result *ValidationResult) {
-	fmt.Println("\n[VALIDATION REPORT]")
-	fmt.Println(strings.Repeat("=", 60))
-
-	// Print checks
-	fmt.Println("\n[CHECKS]")
-	for _, check := range result.Checks {
-		var status string
-		switch check.Status {
-		case "pass":
-			status = "[PASS]"
-		case "warn":
-			status = "[WARN]"
-		case "fail":
-			status = "[FAIL]"
-		}
-
-		fmt.Printf("  %-25s %s", check.Name+":", status)
-		if check.Message != "" {
-			fmt.Printf(" %s", check.Message)
-		}
-		fmt.Println()
-	}
-
-	// Print issues
-	if len(result.Issues) > 0 {
-		fmt.Println("\n[ISSUES]")
-		for i, issue := range result.Issues {
-			fmt.Printf("  %d. [%s] %s\n", i+1, strings.ToUpper(issue.Category), issue.Description)
-			if issue.Suggestion != "" {
-				fmt.Printf("     → %s\n", issue.Suggestion)
-			}
-		}
-	}
-
-	// Print warnings
-	if len(result.Warnings) > 0 {
-		fmt.Println("\n[WARNINGS]")
-		for i, warning := range result.Warnings {
-			fmt.Printf("  %d. [%s] %s\n", i+1, strings.ToUpper(warning.Category), warning.Description)
-			if warning.Suggestion != "" {
-				fmt.Printf("     → %s\n", warning.Suggestion)
-			}
-		}
-	}
-
-	// Print summary
-	fmt.Println("\n" + strings.Repeat("=", 60))
-	if result.Valid {
-		fmt.Printf("[OK] %s\n\n", result.Summary)
-	} else {
-		fmt.Printf("[FAIL] %s\n\n", result.Summary)
-	}
-}

cmd/verify_locks.go

@@ -1,64 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"dbbackup/internal/checks"
-
-	"github.com/spf13/cobra"
-)
-
-var verifyLocksCmd = &cobra.Command{
-	Use:   "verify-locks",
-	Short: "Check PostgreSQL lock settings and print restore guidance",
-	Long:  `Probe PostgreSQL for lock-related GUCs (max_locks_per_transaction, max_connections, max_prepared_transactions) and print capacity + recommended restore options.`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return runVerifyLocks(cmd.Context())
-	},
-}
-
-func runVerifyLocks(ctx context.Context) error {
-	p := checks.NewPreflightChecker(cfg, log)
-	res, err := p.RunAllChecks(ctx, cfg.Database)
-	if err != nil {
-		return err
-	}
-
-	// Find the Postgres lock check in the preflight results
-	var chk checks.PreflightCheck
-	found := false
-	for _, c := range res.Checks {
-		if c.Name == "PostgreSQL lock configuration" {
-			chk = c
-			found = true
-			break
-		}
-	}
-	if !found {
-		fmt.Println("No PostgreSQL lock check available (skipped)")
-		return nil
-	}
-
-	fmt.Printf("%s\n", chk.Name)
-	fmt.Printf("Status: %s\n", chk.Status.String())
-	fmt.Printf("%s\n\n", chk.Message)
-	if chk.Details != "" {
-		fmt.Println(chk.Details)
-	}
-
-	// exit non-zero for failures so scripts can react
-	if chk.Status == checks.StatusFailed {
-		os.Exit(2)
-	}
-	if chk.Status == checks.StatusWarning {
-		os.Exit(0)
-	}
-
-	return nil
-}
-
-func init() {
-	rootCmd.AddCommand(verifyLocksCmd)
-}

cmd/verify_restore.go

@@ -1,371 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"dbbackup/internal/logger"
-	"dbbackup/internal/verification"
-
-	"github.com/spf13/cobra"
-)
-
-var verifyRestoreCmd = &cobra.Command{
-	Use:   "verify-restore",
-	Short: "Systematic verification for large database restores",
-	Long: `Comprehensive verification tool for large database restores with BLOB support.
-
-This tool performs systematic checks to ensure 100% data integrity after restore:
-- Table counts and row counts verification
-- BLOB/Large Object integrity (PostgreSQL large objects, bytea columns)
-- Table checksums (for non-BLOB tables)
-- Database-specific integrity checks
-- Orphaned object detection
-- Index validity checks
-
-Designed to work with VERY LARGE databases and BLOBs with 100% reliability.
-
-Examples:
-  # Verify a restored PostgreSQL database
-  dbbackup verify-restore --engine postgres --database mydb
-
-  # Verify with connection details
-  dbbackup verify-restore --engine postgres --host localhost --port 5432 \
-    --user postgres --password secret --database mydb
-
-  # Verify a MySQL database
-  dbbackup verify-restore --engine mysql --database mydb
-
-  # Verify and output JSON report
-  dbbackup verify-restore --engine postgres --database mydb --json
-
-  # Compare source and restored database
-  dbbackup verify-restore --engine postgres --database source_db --compare restored_db
-
-  # Verify a backup file before restore
-  dbbackup verify-restore --backup-file /backups/mydb.dump
-
-  # Verify multiple databases in parallel
-  dbbackup verify-restore --engine postgres --databases "db1,db2,db3" --parallel 4`,
-	RunE: runVerifyRestore,
-}
-
-var (
-	verifyEngine     string
-	verifyHost       string
-	verifyPort       int
-	verifyUser       string
-	verifyPassword   string
-	verifyDatabase   string
-	verifyDatabases  string
-	verifyCompareDB  string
-	verifyBackupFile string
-	verifyJSON       bool
-	verifyParallel   int
-)
-
-func init() {
-	rootCmd.AddCommand(verifyRestoreCmd)
-
-	verifyRestoreCmd.Flags().StringVar(&verifyEngine, "engine", "postgres", "Database engine (postgres, mysql)")
-	verifyRestoreCmd.Flags().StringVar(&verifyHost, "host", "localhost", "Database host")
-	verifyRestoreCmd.Flags().IntVar(&verifyPort, "port", 5432, "Database port")
-	verifyRestoreCmd.Flags().StringVar(&verifyUser, "user", "", "Database user")
-	verifyRestoreCmd.Flags().StringVar(&verifyPassword, "password", "", "Database password")
-	verifyRestoreCmd.Flags().StringVar(&verifyDatabase, "database", "", "Database to verify")
-	verifyRestoreCmd.Flags().StringVar(&verifyDatabases, "databases", "", "Comma-separated list of databases to verify")
-	verifyRestoreCmd.Flags().StringVar(&verifyCompareDB, "compare", "", "Compare with another database (source vs restored)")
-	verifyRestoreCmd.Flags().StringVar(&verifyBackupFile, "backup-file", "", "Verify backup file integrity before restore")
-	verifyRestoreCmd.Flags().BoolVar(&verifyJSON, "json", false, "Output results as JSON")
-	verifyRestoreCmd.Flags().IntVar(&verifyParallel, "parallel", 1, "Number of parallel verification workers")
-}
-
-func runVerifyRestore(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 24*time.Hour) // Long timeout for large DBs
-	defer cancel()
-
-	log := logger.New("INFO", "text")
-
-	// Get credentials from environment if not provided
-	if verifyUser == "" {
-		verifyUser = os.Getenv("PGUSER")
-		if verifyUser == "" {
-			verifyUser = os.Getenv("MYSQL_USER")
-		}
-		if verifyUser == "" {
-			verifyUser = "postgres"
-		}
-	}
-
-	if verifyPassword == "" {
-		verifyPassword = os.Getenv("PGPASSWORD")
-		if verifyPassword == "" {
-			verifyPassword = os.Getenv("MYSQL_PASSWORD")
-		}
-	}
-
-	// Set default port based on engine
-	if verifyPort == 5432 && (verifyEngine == "mysql" || verifyEngine == "mariadb") {
-		verifyPort = 3306
-	}
-
-	checker := verification.NewLargeRestoreChecker(log, verifyEngine, verifyHost, verifyPort, verifyUser, verifyPassword)
-
-	// Mode 1: Verify backup file
-	if verifyBackupFile != "" {
-		return verifyBackupFileMode(ctx, checker)
-	}
-
-	// Mode 2: Compare two databases
-	if verifyCompareDB != "" {
-		return verifyCompareMode(ctx, checker)
-	}
-
-	// Mode 3: Verify multiple databases in parallel
-	if verifyDatabases != "" {
-		return verifyMultipleDatabases(ctx, log)
-	}
-
-	// Mode 4: Verify single database
-	if verifyDatabase == "" {
-		return fmt.Errorf("--database is required")
-	}
-
-	return verifySingleDatabase(ctx, checker)
-}
-
-func verifyBackupFileMode(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 BACKUP FILE VERIFICATION                            ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-
-	result, err := checker.VerifyBackupFile(ctx, verifyBackupFile)
-	if err != nil {
-		return fmt.Errorf("verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	fmt.Printf("  File:           %s\n", result.Path)
-	fmt.Printf("  Size:           %s\n", formatBytes(result.SizeBytes))
-	fmt.Printf("  Format:         %s\n", result.Format)
-	fmt.Printf("  Checksum:       %s\n", result.Checksum)
-
-	if result.TableCount > 0 {
-		fmt.Printf("  Tables:         %d\n", result.TableCount)
-	}
-	if result.LargeObjectCount > 0 {
-		fmt.Printf("  Large Objects:  %d\n", result.LargeObjectCount)
-	}
-
-	fmt.Println()
-
-	if result.Valid {
-		fmt.Println("  ✅ Backup file verification PASSED")
-	} else {
-		fmt.Printf("  ❌ Backup file verification FAILED: %s\n", result.Error)
-		return fmt.Errorf("verification failed")
-	}
-
-	if len(result.Warnings) > 0 {
-		fmt.Println()
-		fmt.Println("  Warnings:")
-		for _, w := range result.Warnings {
-			fmt.Printf("    ⚠️  %s\n", w)
-		}
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifyCompareMode(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	if verifyDatabase == "" {
-		return fmt.Errorf("--database (source) is required for comparison")
-	}
-
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 DATABASE COMPARISON                                 ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Source:  %s\n", verifyDatabase)
-	fmt.Printf("  Target:  %s\n", verifyCompareDB)
-	fmt.Println()
-
-	result, err := checker.CompareSourceTarget(ctx, verifyDatabase, verifyCompareDB)
-	if err != nil {
-		return fmt.Errorf("comparison failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	if result.Match {
-		fmt.Println("  ✅ Databases MATCH - restore verified successfully")
-	} else {
-		fmt.Println("  ❌ Databases DO NOT MATCH")
-		fmt.Println()
-		fmt.Println("  Differences:")
-		for _, d := range result.Differences {
-			fmt.Printf("    • %s\n", d)
-		}
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifyMultipleDatabases(ctx context.Context, log logger.Logger) error {
-	databases := splitDatabases(verifyDatabases)
-	if len(databases) == 0 {
-		return fmt.Errorf("no databases specified")
-	}
-
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 PARALLEL DATABASE VERIFICATION                      ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Databases: %d\n", len(databases))
-	fmt.Printf("  Workers:   %d\n", verifyParallel)
-	fmt.Println()
-
-	results, err := verification.ParallelVerify(ctx, log, verifyEngine, verifyHost, verifyPort, verifyUser, verifyPassword, databases, verifyParallel)
-	if err != nil {
-		return fmt.Errorf("parallel verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(results, "")
-	}
-
-	allValid := true
-	for _, r := range results {
-		if r == nil {
-			continue
-		}
-		status := "✅"
-		if !r.Valid {
-			status = "❌"
-			allValid = false
-		}
-		fmt.Printf("  %s %s: %d tables, %d rows, %d BLOBs (%s)\n",
-			status, r.Database, r.TotalTables, r.TotalRows, r.TotalBlobCount, r.Duration.Round(time.Millisecond))
-	}
-
-	fmt.Println()
-	if allValid {
-		fmt.Println("  ✅ All databases verified successfully")
-	} else {
-		fmt.Println("  ❌ Some databases failed verification")
-		return fmt.Errorf("verification failed")
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifySingleDatabase(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 SYSTEMATIC RESTORE VERIFICATION                     ║")
-	fmt.Println("║          For Large Databases & BLOBs                         ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Database: %s\n", verifyDatabase)
-	fmt.Printf("  Engine:   %s\n", verifyEngine)
-	fmt.Printf("  Host:     %s:%d\n", verifyHost, verifyPort)
-	fmt.Println()
-
-	result, err := checker.CheckDatabase(ctx, verifyDatabase)
-	if err != nil {
-		return fmt.Errorf("verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	// Summary
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println("  VERIFICATION SUMMARY")
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println()
-	fmt.Printf("  Tables:         %d\n", result.TotalTables)
-	fmt.Printf("  Total Rows:     %d\n", result.TotalRows)
-	fmt.Printf("  Large Objects:  %d\n", result.TotalBlobCount)
-	fmt.Printf("  BLOB Size:      %s\n", formatBytes(result.TotalBlobBytes))
-	fmt.Printf("  Duration:       %s\n", result.Duration.Round(time.Millisecond))
-	fmt.Println()
-
-	// Table details
-	if len(result.TableChecks) > 0 && len(result.TableChecks) <= 50 {
-		fmt.Println("  Tables:")
-		for _, t := range result.TableChecks {
-			blobIndicator := ""
-			if t.HasBlobColumn {
-				blobIndicator = " [BLOB]"
-			}
-			status := "✓"
-			if !t.Valid {
-				status = "✗"
-			}
-			fmt.Printf("    %s %s.%s: %d rows%s\n", status, t.Schema, t.TableName, t.RowCount, blobIndicator)
-		}
-		fmt.Println()
-	}
-
-	// Integrity errors
-	if len(result.IntegrityErrors) > 0 {
-		fmt.Println("  ❌ INTEGRITY ERRORS:")
-		for _, e := range result.IntegrityErrors {
-			fmt.Printf("    • %s\n", e)
-		}
-		fmt.Println()
-	}
-
-	// Warnings
-	if len(result.Warnings) > 0 {
-		fmt.Println("  ⚠️  WARNINGS:")
-		for _, w := range result.Warnings {
-			fmt.Printf("    • %s\n", w)
-		}
-		fmt.Println()
-	}
-
-	// Final verdict
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	if result.Valid {
-		fmt.Println("  ✅ RESTORE VERIFICATION PASSED - Data integrity confirmed")
-	} else {
-		fmt.Println("  ❌ RESTORE VERIFICATION FAILED - See errors above")
-		return fmt.Errorf("verification failed")
-	}
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	return nil
-}
-
-func splitDatabases(s string) []string {
-	if s == "" {
-		return nil
-	}
-	var dbs []string
-	for _, db := range strings.Split(s, ",") {
-		db = strings.TrimSpace(db)
-		if db != "" {
-			dbs = append(dbs, db)
-		}
-	}
-	return dbs
-}

cmd/version.go

@@ -1,159 +0,0 @@
-// Package cmd - version command showing detailed build and system info
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"strings"
-
-	"github.com/spf13/cobra"
-)
-
-var versionOutputFormat string
-
-var versionCmd = &cobra.Command{
-	Use:   "version",
-	Short: "Show detailed version and system information",
-	Long: `Display comprehensive version information including:
-
-  - dbbackup version, build time, and git commit
-  - Go runtime version
-  - Operating system and architecture
-  - Installed database tool versions (pg_dump, mysqldump, etc.)
-  - System information
-
-Useful for troubleshooting and bug reports.
-
-Examples:
-  # Show version info
-  dbbackup version
-
-  # JSON output for scripts
-  dbbackup version --format json
-
-  # Short version only
-  dbbackup version --format short`,
-	Run: runVersionCmd,
-}
-
-func init() {
-	rootCmd.AddCommand(versionCmd)
-	versionCmd.Flags().StringVar(&versionOutputFormat, "format", "table", "Output format (table, json, short)")
-}
-
-type versionInfo struct {
-	Version       string            `json:"version"`
-	BuildTime     string            `json:"build_time"`
-	GitCommit     string            `json:"git_commit"`
-	GoVersion     string            `json:"go_version"`
-	OS            string            `json:"os"`
-	Arch          string            `json:"arch"`
-	NumCPU        int               `json:"num_cpu"`
-	DatabaseTools map[string]string `json:"database_tools"`
-}
-
-func runVersionCmd(cmd *cobra.Command, args []string) {
-	info := collectVersionInfo()
-
-	switch versionOutputFormat {
-	case "json":
-		outputVersionJSON(info)
-	case "short":
-		fmt.Printf("dbbackup %s\n", info.Version)
-	default:
-		outputTable(info)
-	}
-}
-
-func collectVersionInfo() versionInfo {
-	info := versionInfo{
-		Version:       cfg.Version,
-		BuildTime:     cfg.BuildTime,
-		GitCommit:     cfg.GitCommit,
-		GoVersion:     runtime.Version(),
-		OS:            runtime.GOOS,
-		Arch:          runtime.GOARCH,
-		NumCPU:        runtime.NumCPU(),
-		DatabaseTools: make(map[string]string),
-	}
-
-	// Check database tools
-	tools := []struct {
-		name    string
-		command string
-		args    []string
-	}{
-		{"pg_dump", "pg_dump", []string{"--version"}},
-		{"pg_restore", "pg_restore", []string{"--version"}},
-		{"psql", "psql", []string{"--version"}},
-		{"mysqldump", "mysqldump", []string{"--version"}},
-		{"mysql", "mysql", []string{"--version"}},
-		{"mariadb-dump", "mariadb-dump", []string{"--version"}},
-	}
-
-	for _, tool := range tools {
-		version := getToolVersion(tool.command, tool.args)
-		if version != "" {
-			info.DatabaseTools[tool.name] = version
-		}
-	}
-
-	return info
-}
-
-func getToolVersion(command string, args []string) string {
-	cmd := exec.Command(command, args...)
-	output, err := cmd.Output()
-	if err != nil {
-		return ""
-	}
-
-	// Parse first line and extract version
-	line := strings.Split(string(output), "\n")[0]
-	line = strings.TrimSpace(line)
-
-	// Try to extract just the version number
-	// e.g., "pg_dump (PostgreSQL) 16.1" -> "16.1"
-	// e.g., "mysqldump  Ver 8.0.35" -> "8.0.35"
-	parts := strings.Fields(line)
-	if len(parts) > 0 {
-		// Return last part which is usually the version
-		return parts[len(parts)-1]
-	}
-
-	return line
-}
-
-func outputVersionJSON(info versionInfo) {
-	enc := json.NewEncoder(os.Stdout)
-	enc.SetIndent("", "  ")
-	enc.Encode(info)
-}
-
-func outputTable(info versionInfo) {
-	fmt.Println()
-	fmt.Println("dbbackup Version Info")
-	fmt.Println("=====================================================")
-	fmt.Printf("  Version:         %s\n", info.Version)
-	fmt.Printf("  Build Time:      %s\n", info.BuildTime)
-	fmt.Printf("  Git Commit:      %s\n", info.GitCommit)
-	fmt.Println()
-	fmt.Printf("  Go Version:      %s\n", info.GoVersion)
-	fmt.Printf("  OS/Arch:         %s/%s\n", info.OS, info.Arch)
-	fmt.Printf("  CPU Cores:       %d\n", info.NumCPU)
-
-	if len(info.DatabaseTools) > 0 {
-		fmt.Println()
-		fmt.Println("Database Tools")
-		fmt.Println("-----------------------------------------------------")
-		for tool, version := range info.DatabaseTools {
-			fmt.Printf("  %-18s %s\n", tool+":", version)
-		}
-	}
-
-	fmt.Println("=====================================================")
-	fmt.Println()
-}

deploy/README.md

@@ -1,64 +0,0 @@
-# Deployment Examples for dbbackup
-
-Enterprise deployment configurations for various platforms and orchestration tools.
-
-## Directory Structure
-
-```
-deploy/
-├── README.md
-├── ansible/              # Ansible roles and playbooks
-│   ├── basic.yml         # Simple installation
-│   ├── with-exporter.yml # With Prometheus metrics
-│   ├── with-notifications.yml # With email/Slack alerts
-│   └── enterprise.yml    # Full enterprise setup
-├── kubernetes/           # Kubernetes manifests
-│   ├── cronjob.yaml      # Scheduled backup CronJob
-│   ├── configmap.yaml    # Configuration
-│   ├── pvc.yaml          # Persistent volume claim
-│   ├── secret.yaml.example # Secrets template
-│   └── servicemonitor.yaml # Prometheus ServiceMonitor
-├── prometheus/           # Prometheus configuration
-│   ├── alerting-rules.yaml
-│   └── scrape-config.yaml
-├── terraform/            # Infrastructure as Code
-│   └── aws/              # AWS deployment (S3 bucket)
-└── scripts/              # Helper scripts
-    ├── backup-rotation.sh
-    └── health-check.sh
-```
-
-## Quick Start by Platform
-
-### Ansible
-```bash
-cd ansible
-cp inventory.example inventory
-ansible-playbook -i inventory enterprise.yml
-```
-
-### Kubernetes
-```bash
-kubectl apply -f kubernetes/
-```
-
-### Terraform (AWS)
-```bash
-cd terraform/aws
-terraform init
-terraform apply
-```
-
-## Feature Matrix
-
-| Feature | basic | with-exporter | with-notifications | enterprise |
-|---------|:-----:|:-------------:|:------------------:|:----------:|
-| Scheduled Backups | ✓ | ✓ | ✓ | ✓ |
-| Retention Policy | ✓ | ✓ | ✓ | ✓ |
-| GFS Rotation | | | | ✓ |
-| Prometheus Metrics | | ✓ | | ✓ |
-| Email Notifications | | | ✓ | ✓ |
-| Slack/Webhook | | | ✓ | ✓ |
-| Encryption | | | | ✓ |
-| Cloud Upload | | | | ✓ |
-| Catalog Sync | | | | ✓ |

deploy/ansible/README.md

@@ -1,75 +0,0 @@
-# Ansible Deployment for dbbackup
-
-Ansible roles and playbooks for deploying dbbackup in enterprise environments.
-
-## Playbooks
-
-| Playbook | Description |
-|----------|-------------|
-| `basic.yml` | Simple installation without monitoring |
-| `with-exporter.yml` | Installation with Prometheus metrics exporter |
-| `with-notifications.yml` | Installation with SMTP/webhook notifications |
-| `enterprise.yml` | Full enterprise setup (exporter + notifications + GFS retention) |
-
-## Quick Start
-
-```bash
-# Edit inventory
-cp inventory.example inventory
-vim inventory
-
-# Edit variables
-vim group_vars/all.yml
-
-# Deploy basic setup
-ansible-playbook -i inventory basic.yml
-
-# Deploy enterprise setup
-ansible-playbook -i inventory enterprise.yml
-```
-
-## Variables
-
-See `group_vars/all.yml` for all configurable options.
-
-### Required Variables
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `dbbackup_version` | Version to install | `3.42.74` |
-| `dbbackup_db_type` | Database type | `postgres` or `mysql` |
-| `dbbackup_backup_dir` | Backup storage path | `/var/backups/databases` |
-
-### Optional Variables
-
-| Variable | Description | Default |
-|----------|-------------|---------|
-| `dbbackup_schedule` | Backup schedule | `daily` |
-| `dbbackup_compression` | Compression level | `6` |
-| `dbbackup_retention_days` | Retention period | `30` |
-| `dbbackup_min_backups` | Minimum backups to keep | `5` |
-| `dbbackup_exporter_port` | Prometheus exporter port | `9399` |
-
-## Directory Structure
-
-```
-ansible/
-├── README.md
-├── inventory.example
-├── group_vars/
-│   └── all.yml
-├── roles/
-│   └── dbbackup/
-│       ├── tasks/
-│       │   └── main.yml
-│       ├── templates/
-│       │   ├── dbbackup.conf.j2
-│       │   ├── env.j2
-│       │   └── systemd-override.conf.j2
-│       └── handlers/
-│           └── main.yml
-├── basic.yml
-├── with-exporter.yml
-├── with-notifications.yml
-└── enterprise.yml
-```

deploy/ansible/basic.yml

@@ -1,42 +0,0 @@
----
-# dbbackup Basic Deployment
-# Simple installation without monitoring or notifications
-#
-# Usage:
-#   ansible-playbook -i inventory basic.yml
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy (30 days default)
-#   ✗ No Prometheus exporter
-#   ✗ No notifications
-
-- name: Deploy dbbackup (basic)
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: false
-    dbbackup_notify_enabled: false
-  
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Verify installation
-      command: "{{ dbbackup_install_dir }}/dbbackup --version"
-      register: version_check
-      changed_when: false
-
-    - name: Display version
-      debug:
-        msg: "Installed: {{ version_check.stdout }}"
-
-    - name: Show timer status
-      command: systemctl status dbbackup-{{ dbbackup_backup_type }}.timer --no-pager
-      register: timer_status
-      changed_when: false
-
-    - name: Display next backup time
-      debug:
-        msg: "{{ timer_status.stdout_lines | select('search', 'Trigger') | list }}"

deploy/ansible/deploy-production.yml

@@ -1,104 +0,0 @@
----
-# dbbackup Production Deployment Playbook
-# Deploys dbbackup binary and verifies backup jobs
-#
-# Usage (from dev.uuxo.net):
-#   ansible-playbook -i inventory.yml deploy-production.yml
-#   ansible-playbook -i inventory.yml deploy-production.yml --limit mysql01.uuxoi.local
-#   ansible-playbook -i inventory.yml deploy-production.yml --tags binary  # Only deploy binary
-
-- name: Deploy dbbackup to production DB hosts
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    # Binary source: /tmp/dbbackup_linux_amd64 on Ansible controller (dev.uuxo.net)
-    local_binary: "{{ dbbackup_binary_src | default('/tmp/dbbackup_linux_amd64') }}"
-    install_path: /usr/local/bin/dbbackup
-  
-  tasks:
-    - name: Deploy dbbackup binary
-      tags: [binary, deploy]
-      block:
-        - name: Copy dbbackup binary
-          copy:
-            src: "{{ local_binary }}"
-            dest: "{{ install_path }}"
-            mode: "0755"
-            owner: root
-            group: root
-          register: binary_deployed
-
-        - name: Verify dbbackup version
-          command: "{{ install_path }} --version"
-          register: version_check
-          changed_when: false
-
-        - name: Display installed version
-          debug:
-            msg: "{{ inventory_hostname }}: {{ version_check.stdout }}"
-
-    - name: Check backup configuration
-      tags: [verify, check]
-      block:
-        - name: Check backup script exists
-          stat:
-            path: "/opt/dbbackup/bin/{{ dbbackup_backup_script | default('backup.sh') }}"
-          register: backup_script
-
-        - name: Display backup script status
-          debug:
-            msg: "Backup script: {{ 'EXISTS' if backup_script.stat.exists else 'MISSING' }}"
-
-        - name: Check systemd timer status
-          shell: systemctl list-timers --no-pager | grep dbbackup || echo "No timer found"
-          register: timer_status
-          changed_when: false
-
-        - name: Display timer status
-          debug:
-            msg: "{{ timer_status.stdout_lines }}"
-
-        - name: Check exporter service
-          shell: systemctl is-active dbbackup-exporter 2>/dev/null || echo "not running"
-          register: exporter_status
-          changed_when: false
-
-        - name: Display exporter status
-          debug:
-            msg: "Exporter: {{ exporter_status.stdout }}"
-
-    - name: Run test backup (dry-run)
-      tags: [test, never]
-      block:
-        - name: Execute dry-run backup
-          command: >
-            {{ install_path }} backup single {{ dbbackup_databases[0] }}
-            --db-type {{ dbbackup_db_type }}
-            {% if dbbackup_socket is defined %}--socket {{ dbbackup_socket }}{% endif %}
-            {% if dbbackup_host is defined %}--host {{ dbbackup_host }}{% endif %}
-            {% if dbbackup_port is defined %}--port {{ dbbackup_port }}{% endif %}
-            --user root
-            --allow-root
-            --dry-run
-          environment:
-            MYSQL_PWD: "{{ dbbackup_password | default('') }}"
-          register: dryrun_result
-          changed_when: false
-          ignore_errors: yes
-
-        - name: Display dry-run result
-          debug:
-            msg: "{{ dryrun_result.stdout_lines[-5:] }}"
-
-  post_tasks:
-    - name: Deployment summary
-      debug:
-        msg: |
-          === {{ inventory_hostname }} ===
-          Version: {{ version_check.stdout | default('unknown') }}
-          DB Type: {{ dbbackup_db_type }}
-          Databases: {{ dbbackup_databases | join(', ') }}
-          Backup Dir: {{ dbbackup_backup_dir }}
-          Timer: {{ 'active' if 'dbbackup' in timer_status.stdout else 'not configured' }}
-          Exporter: {{ exporter_status.stdout }}

deploy/ansible/enterprise.yml

@@ -1,153 +0,0 @@
----
-# dbbackup Enterprise Deployment
-# Full-featured installation with all enterprise capabilities
-#
-# Usage:
-#   ansible-playbook -i inventory enterprise.yml
-#
-# Features:
-#   ✓ Automated scheduled backups
-#   ✓ GFS retention policy (Grandfather-Father-Son)
-#   ✓ Prometheus metrics exporter
-#   ✓ SMTP email notifications
-#   ✓ Webhook/Slack notifications
-#   ✓ Encrypted backups (optional)
-#   ✓ Cloud storage upload (optional)
-#   ✓ Catalog for backup tracking
-#
-# Required Vault Variables:
-#   dbbackup_db_password
-#   dbbackup_encryption_key (if encryption enabled)
-#   dbbackup_notify_smtp_password (if SMTP enabled)
-#   dbbackup_cloud_access_key (if cloud enabled)
-#   dbbackup_cloud_secret_key (if cloud enabled)
-
-- name: Deploy dbbackup (Enterprise)
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    # Full feature set
-    dbbackup_exporter_enabled: true
-    dbbackup_exporter_port: 9399
-    dbbackup_notify_enabled: true
-    
-    # GFS Retention
-    dbbackup_gfs_enabled: true
-    dbbackup_gfs_daily: 7
-    dbbackup_gfs_weekly: 4
-    dbbackup_gfs_monthly: 12
-    dbbackup_gfs_yearly: 3
-    
-  pre_tasks:
-    - name: Check for required secrets
-      assert:
-        that:
-          - dbbackup_db_password is defined
-        fail_msg: "Required secrets not provided. Use ansible-vault for dbbackup_db_password"
-
-    - name: Validate encryption key if enabled
-      assert:
-        that:
-          - dbbackup_encryption_key is defined
-          - dbbackup_encryption_key | length >= 16
-        fail_msg: "Encryption enabled but key not provided or too short"
-      when: dbbackup_encryption_enabled | default(false)
-
-  roles:
-    - dbbackup
-
-  post_tasks:
-    # Verify exporter
-    - name: Wait for exporter to start
-      wait_for:
-        port: "{{ dbbackup_exporter_port }}"
-        timeout: 30
-      when: dbbackup_exporter_enabled
-
-    - name: Test metrics endpoint
-      uri:
-        url: "http://localhost:{{ dbbackup_exporter_port }}/metrics"
-        return_content: yes
-      register: metrics_response
-      when: dbbackup_exporter_enabled
-
-    # Initialize catalog
-    - name: Sync existing backups to catalog
-      command: "{{ dbbackup_install_dir }}/dbbackup catalog sync {{ dbbackup_backup_dir }}"
-      become_user: dbbackup
-      changed_when: false
-
-    # Run preflight check
-    - name: Run preflight checks
-      command: "{{ dbbackup_install_dir }}/dbbackup preflight"
-      become_user: dbbackup
-      register: preflight_result
-      changed_when: false
-      failed_when: preflight_result.rc > 1  # rc=1 is warnings, rc=2 is failure
-
-    - name: Display preflight result
-      debug:
-        msg: "{{ preflight_result.stdout_lines }}"
-
-    # Summary
-    - name: Display deployment summary
-      debug:
-        msg: |
-          ╔══════════════════════════════════════════════════════════════╗
-          ║             dbbackup Enterprise Deployment Complete          ║
-          ╚══════════════════════════════════════════════════════════════╝
-          
-          Host: {{ inventory_hostname }}
-          Version: {{ dbbackup_version }}
-          
-          ┌─ Backup Configuration ─────────────────────────────────────────
-          │ Type: {{ dbbackup_backup_type }}
-          │ Schedule: {{ dbbackup_schedule }}
-          │ Directory: {{ dbbackup_backup_dir }}
-          │ Encryption: {{ 'Enabled' if dbbackup_encryption_enabled else 'Disabled' }}
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Retention Policy (GFS) ───────────────────────────────────────
-          │ Daily: {{ dbbackup_gfs_daily }} backups
-          │ Weekly: {{ dbbackup_gfs_weekly }} backups
-          │ Monthly: {{ dbbackup_gfs_monthly }} backups
-          │ Yearly: {{ dbbackup_gfs_yearly }} backups
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Monitoring ───────────────────────────────────────────────────
-          │ Prometheus: http://{{ inventory_hostname }}:{{ dbbackup_exporter_port }}/metrics
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Notifications ────────────────────────────────────────────────
-          {% if dbbackup_notify_smtp_enabled | default(false) %}
-          │ SMTP: {{ dbbackup_notify_smtp_to | join(', ') }}
-          {% endif %}
-          {% if dbbackup_notify_slack_enabled | default(false) %}
-          │ Slack: Enabled
-          {% endif %}
-          └────────────────────────────────────────────────────────────────
-
-- name: Configure Prometheus scrape targets
-  hosts: monitoring
-  become: yes
-  tasks:
-    - name: Add dbbackup targets to prometheus
-      blockinfile:
-        path: /etc/prometheus/targets/dbbackup.yml
-        create: yes
-        block: |
-          - targets:
-          {% for host in groups['db_servers'] %}
-              - {{ host }}:{{ hostvars[host]['dbbackup_exporter_port'] | default(9399) }}
-          {% endfor %}
-            labels:
-              job: dbbackup
-      notify: reload prometheus
-      when: "'monitoring' in group_names"
-
-  handlers:
-    - name: reload prometheus
-      systemd:
-        name: prometheus
-        state: reloaded

deploy/ansible/group_vars/all.yml

@@ -1,71 +0,0 @@
-# dbbackup Ansible Variables
-# =========================
-
-# Version and Installation
-dbbackup_version: "3.42.74"
-dbbackup_download_url: "https://git.uuxo.net/UUXO/dbbackup/releases/download/v{{ dbbackup_version }}"
-dbbackup_install_dir: "/usr/local/bin"
-dbbackup_config_dir: "/etc/dbbackup"
-dbbackup_data_dir: "/var/lib/dbbackup"
-dbbackup_log_dir: "/var/log/dbbackup"
-
-# Database Configuration
-dbbackup_db_type: "postgres"  # postgres, mysql, mariadb
-dbbackup_db_host: "localhost"
-dbbackup_db_port: 5432        # 5432 for postgres, 3306 for mysql
-dbbackup_db_user: "postgres"
-# dbbackup_db_password: ""    # Use vault for passwords!
-
-# Backup Configuration
-dbbackup_backup_dir: "/var/backups/databases"
-dbbackup_backup_type: "cluster"  # cluster, single
-dbbackup_compression: 6
-dbbackup_encryption_enabled: false
-# dbbackup_encryption_key: "" # Use vault!
-
-# Schedule (systemd OnCalendar format)
-dbbackup_schedule: "daily"  # daily, weekly, *-*-* 02:00:00
-
-# Retention Policy
-dbbackup_retention_days: 30
-dbbackup_min_backups: 5
-
-# GFS Retention (enterprise.yml)
-dbbackup_gfs_enabled: false
-dbbackup_gfs_daily: 7
-dbbackup_gfs_weekly: 4
-dbbackup_gfs_monthly: 12
-dbbackup_gfs_yearly: 3
-
-# Prometheus Exporter (with-exporter.yml, enterprise.yml)
-dbbackup_exporter_enabled: false
-dbbackup_exporter_port: 9399
-
-# Cloud Storage (optional)
-dbbackup_cloud_enabled: false
-dbbackup_cloud_provider: "s3"  # s3, minio, b2, azure, gcs
-dbbackup_cloud_bucket: ""
-dbbackup_cloud_endpoint: ""    # For MinIO/B2
-# dbbackup_cloud_access_key: "" # Use vault!
-# dbbackup_cloud_secret_key: "" # Use vault!
-
-# Notifications (with-notifications.yml, enterprise.yml)
-dbbackup_notify_enabled: false
-
-# SMTP Notifications
-dbbackup_notify_smtp_enabled: false
-dbbackup_notify_smtp_host: ""
-dbbackup_notify_smtp_port: 587
-dbbackup_notify_smtp_user: ""
-# dbbackup_notify_smtp_password: "" # Use vault!
-dbbackup_notify_smtp_from: ""
-dbbackup_notify_smtp_to: []  # List of recipients
-
-# Webhook Notifications
-dbbackup_notify_webhook_enabled: false
-dbbackup_notify_webhook_url: ""
-# dbbackup_notify_webhook_secret: "" # Use vault for HMAC secret!
-
-# Slack Integration (uses webhook)
-dbbackup_notify_slack_enabled: false
-dbbackup_notify_slack_webhook: ""

deploy/ansible/inventory.example

@@ -1,25 +0,0 @@
-# dbbackup Ansible Inventory Example
-# Copy to 'inventory' and customize
-
-[db_servers]
-# PostgreSQL servers
-pg-primary.example.com   dbbackup_db_type=postgres
-pg-replica.example.com   dbbackup_db_type=postgres dbbackup_backup_from_replica=true
-
-# MySQL servers  
-mysql-01.example.com     dbbackup_db_type=mysql
-
-[db_servers:vars]
-ansible_user=deploy
-ansible_become=yes
-
-# Group-level defaults
-dbbackup_backup_dir=/var/backups/databases
-dbbackup_schedule=daily
-
-[monitoring]
-prometheus.example.com
-
-[monitoring:vars]
-# Servers where metrics are scraped
-dbbackup_exporter_enabled=true

deploy/ansible/inventory.yml

@@ -1,56 +0,0 @@
-# dbbackup Production Inventory
-# Ansible läuft auf dev.uuxo.net - direkter SSH-Zugang zu allen Hosts
-
-all:
-  vars:
-    ansible_user: root
-    ansible_ssh_common_args: '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
-    dbbackup_version: "5.7.2"
-    # Binary wird von dev.uuxo.net aus deployed (dort liegt es in /tmp nach scp)
-    dbbackup_binary_src: "/tmp/dbbackup_linux_amd64"
-
-  children:
-    db_servers:
-      hosts:
-        mysql01.uuxoi.local:
-          dbbackup_db_type: mariadb
-          dbbackup_databases: 
-            - ejabberd
-          dbbackup_backup_dir: /mnt/smb-mysql01/backups/databases
-          dbbackup_socket: /var/run/mysqld/mysqld.sock
-          dbbackup_pitr_enabled: true
-          dbbackup_backup_script: backup-mysql01.sh
-
-        alternate.uuxoi.local:
-          dbbackup_db_type: mariadb
-          dbbackup_databases:
-            - dbispconfig
-            - c1aps1
-            - c2marianskronkorken
-            - matomo
-            - phpmyadmin
-            - roundcube
-            - roundcubemail
-          dbbackup_backup_dir: /mnt/smb-alternate/backups/databases
-          dbbackup_host: 127.0.0.1
-          dbbackup_port: 3306
-          dbbackup_password: "xt3kci28"
-          dbbackup_backup_script: backup-alternate.sh
-
-        cloud.uuxoi.local:
-          dbbackup_db_type: mariadb
-          dbbackup_databases:
-            - nextcloud_db
-          dbbackup_backup_dir: /mnt/smb-cloud/backups/dedup
-          dbbackup_socket: /var/run/mysqld/mysqld.sock
-          dbbackup_dedup_enabled: true
-          dbbackup_backup_script: backup-cloud.sh
-
-    # Hosts mit speziellen Anforderungen
-    special_hosts:
-      hosts:
-        git.uuxoi.local:
-          dbbackup_db_type: mariadb
-          dbbackup_databases:
-            - gitea
-          dbbackup_note: "Docker-based MariaDB - needs SSH key setup"

deploy/ansible/roles/dbbackup/handlers/main.yml

@@ -1,12 +0,0 @@
----
-# dbbackup Ansible Role - Handlers
-
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
-
-- name: restart dbbackup
-  systemd:
-    name: "dbbackup-{{ dbbackup_backup_type }}.service"
-    state: restarted
-  when: ansible_service_mgr == 'systemd'

deploy/ansible/roles/dbbackup/tasks/main.yml

@@ -1,116 +0,0 @@
----
-# dbbackup Ansible Role - Main Tasks
-
-- name: Create dbbackup group
-  group:
-    name: dbbackup
-    system: yes
-
-- name: Create dbbackup user
-  user:
-    name: dbbackup
-    group: dbbackup
-    system: yes
-    home: "{{ dbbackup_data_dir }}"
-    shell: /usr/sbin/nologin
-    create_home: no
-
-- name: Create directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: dbbackup
-    group: dbbackup
-    mode: "0755"
-  loop:
-    - "{{ dbbackup_config_dir }}"
-    - "{{ dbbackup_data_dir }}"
-    - "{{ dbbackup_data_dir }}/catalog"
-    - "{{ dbbackup_log_dir }}"
-    - "{{ dbbackup_backup_dir }}"
-
-- name: Create env.d directory
-  file:
-    path: "{{ dbbackup_config_dir }}/env.d"
-    state: directory
-    owner: root
-    group: dbbackup
-    mode: "0750"
-
-- name: Detect architecture
-  set_fact:
-    dbbackup_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
-
-- name: Download dbbackup binary
-  get_url:
-    url: "{{ dbbackup_download_url }}/dbbackup-linux-{{ dbbackup_arch }}"
-    dest: "{{ dbbackup_install_dir }}/dbbackup"
-    mode: "0755"
-    owner: root
-    group: root
-  notify: restart dbbackup
-
-- name: Deploy configuration file
-  template:
-    src: dbbackup.conf.j2
-    dest: "{{ dbbackup_config_dir }}/dbbackup.conf"
-    owner: root
-    group: dbbackup
-    mode: "0640"
-  notify: restart dbbackup
-
-- name: Deploy environment file
-  template:
-    src: env.j2
-    dest: "{{ dbbackup_config_dir }}/env.d/{{ dbbackup_backup_type }}.conf"
-    owner: root
-    group: dbbackup
-    mode: "0600"
-  notify: restart dbbackup
-
-- name: Install systemd service
-  command: >
-    {{ dbbackup_install_dir }}/dbbackup install
-    --backup-type {{ dbbackup_backup_type }}
-    --schedule "{{ dbbackup_schedule }}"
-    {% if dbbackup_exporter_enabled %}--with-metrics --metrics-port {{ dbbackup_exporter_port }}{% endif %}
-  args:
-    creates: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service"
-  notify:
-    - reload systemd
-    - restart dbbackup
-
-- name: Deploy systemd override (if customizations needed)
-  template:
-    src: systemd-override.conf.j2
-    dest: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service.d/override.conf"
-    owner: root
-    group: root
-    mode: "0644"
-  when: dbbackup_notify_enabled or dbbackup_cloud_enabled
-  notify:
-    - reload systemd
-    - restart dbbackup
-
-- name: Create systemd override directory
-  file:
-    path: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service.d"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when: dbbackup_notify_enabled or dbbackup_cloud_enabled
-
-- name: Enable and start dbbackup timer
-  systemd:
-    name: "dbbackup-{{ dbbackup_backup_type }}.timer"
-    enabled: yes
-    state: started
-    daemon_reload: yes
-
-- name: Enable dbbackup exporter service
-  systemd:
-    name: dbbackup-exporter
-    enabled: yes
-    state: started
-  when: dbbackup_exporter_enabled

deploy/ansible/roles/dbbackup/templates/dbbackup.conf.j2

@@ -1,39 +0,0 @@
-# dbbackup Configuration
-# Managed by Ansible - do not edit manually
-
-# Database
-db-type = {{ dbbackup_db_type }}
-host = {{ dbbackup_db_host }}
-port = {{ dbbackup_db_port }}
-user = {{ dbbackup_db_user }}
-
-# Backup
-backup-dir = {{ dbbackup_backup_dir }}
-compression = {{ dbbackup_compression }}
-
-# Retention
-retention-days = {{ dbbackup_retention_days }}
-min-backups = {{ dbbackup_min_backups }}
-
-{% if dbbackup_gfs_enabled %}
-# GFS Retention Policy
-gfs = true
-gfs-daily = {{ dbbackup_gfs_daily }}
-gfs-weekly = {{ dbbackup_gfs_weekly }}
-gfs-monthly = {{ dbbackup_gfs_monthly }}
-gfs-yearly = {{ dbbackup_gfs_yearly }}
-{% endif %}
-
-{% if dbbackup_encryption_enabled %}
-# Encryption
-encrypt = true
-{% endif %}
-
-{% if dbbackup_cloud_enabled %}
-# Cloud Storage
-cloud-provider = {{ dbbackup_cloud_provider }}
-cloud-bucket = {{ dbbackup_cloud_bucket }}
-{% if dbbackup_cloud_endpoint %}
-cloud-endpoint = {{ dbbackup_cloud_endpoint }}
-{% endif %}
-{% endif %}

deploy/ansible/roles/dbbackup/templates/env.j2

@@ -1,57 +0,0 @@
-# dbbackup Environment Variables
-# Managed by Ansible - do not edit manually
-# Permissions: 0600 (secrets inside)
-
-{% if dbbackup_db_password is defined %}
-# Database Password
-{% if dbbackup_db_type == 'postgres' %}
-PGPASSWORD={{ dbbackup_db_password }}
-{% else %}
-MYSQL_PWD={{ dbbackup_db_password }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_encryption_enabled and dbbackup_encryption_key is defined %}
-# Encryption Key
-DBBACKUP_ENCRYPTION_KEY={{ dbbackup_encryption_key }}
-{% endif %}
-
-{% if dbbackup_cloud_enabled %}
-# Cloud Storage Credentials
-{% if dbbackup_cloud_provider in ['s3', 'minio', 'b2'] %}
-AWS_ACCESS_KEY_ID={{ dbbackup_cloud_access_key | default('') }}
-AWS_SECRET_ACCESS_KEY={{ dbbackup_cloud_secret_key | default('') }}
-{% endif %}
-{% if dbbackup_cloud_provider == 'azure' %}
-AZURE_STORAGE_ACCOUNT={{ dbbackup_cloud_access_key | default('') }}
-AZURE_STORAGE_KEY={{ dbbackup_cloud_secret_key | default('') }}
-{% endif %}
-{% if dbbackup_cloud_provider == 'gcs' %}
-GOOGLE_APPLICATION_CREDENTIALS={{ dbbackup_cloud_credentials_file | default('/etc/dbbackup/gcs-credentials.json') }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_notify_smtp_enabled %}
-# SMTP Notifications
-NOTIFY_SMTP_HOST={{ dbbackup_notify_smtp_host }}
-NOTIFY_SMTP_PORT={{ dbbackup_notify_smtp_port }}
-NOTIFY_SMTP_USER={{ dbbackup_notify_smtp_user }}
-{% if dbbackup_notify_smtp_password is defined %}
-NOTIFY_SMTP_PASSWORD={{ dbbackup_notify_smtp_password }}
-{% endif %}
-NOTIFY_SMTP_FROM={{ dbbackup_notify_smtp_from }}
-NOTIFY_SMTP_TO={{ dbbackup_notify_smtp_to | join(',') }}
-{% endif %}
-
-{% if dbbackup_notify_webhook_enabled %}
-# Webhook Notifications
-NOTIFY_WEBHOOK_URL={{ dbbackup_notify_webhook_url }}
-{% if dbbackup_notify_webhook_secret is defined %}
-NOTIFY_WEBHOOK_SECRET={{ dbbackup_notify_webhook_secret }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_notify_slack_enabled %}
-# Slack Notifications
-NOTIFY_WEBHOOK_URL={{ dbbackup_notify_slack_webhook }}
-{% endif %}

deploy/ansible/roles/dbbackup/templates/systemd-override.conf.j2

@@ -1,6 +0,0 @@
-# dbbackup Systemd Override
-# Managed by Ansible
-
-[Service]
-# Load environment from secure file
-EnvironmentFile=-{{ dbbackup_config_dir }}/env.d/{{ dbbackup_backup_type }}.conf

deploy/ansible/with-exporter.yml

@@ -1,52 +0,0 @@
----
-# dbbackup with Prometheus Exporter
-# Installation with metrics endpoint for monitoring
-#
-# Usage:
-#   ansible-playbook -i inventory with-exporter.yml
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy
-#   ✓ Prometheus exporter on port 9399
-#   ✗ No notifications
-
-- name: Deploy dbbackup with Prometheus exporter
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: true
-    dbbackup_exporter_port: 9399
-    dbbackup_notify_enabled: false
-  
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Wait for exporter to start
-      wait_for:
-        port: "{{ dbbackup_exporter_port }}"
-        timeout: 30
-
-    - name: Test metrics endpoint
-      uri:
-        url: "http://localhost:{{ dbbackup_exporter_port }}/metrics"
-        return_content: yes
-      register: metrics_response
-
-    - name: Verify metrics available
-      assert:
-        that:
-          - "'dbbackup_' in metrics_response.content"
-        fail_msg: "Metrics endpoint not returning dbbackup metrics"
-        success_msg: "Prometheus exporter running on port {{ dbbackup_exporter_port }}"
-
-    - name: Display Prometheus scrape config
-      debug:
-        msg: |
-          Add to prometheus.yml:
-          
-          - job_name: 'dbbackup'
-            static_configs:
-              - targets: ['{{ inventory_hostname }}:{{ dbbackup_exporter_port }}']

deploy/ansible/with-notifications.yml

@@ -1,84 +0,0 @@
----
-# dbbackup with Notifications
-# Installation with SMTP email and/or webhook notifications
-#
-# Usage:
-#   # With SMTP notifications
-#   ansible-playbook -i inventory with-notifications.yml \
-#     -e dbbackup_notify_smtp_enabled=true \
-#     -e dbbackup_notify_smtp_host=smtp.example.com \
-#     -e dbbackup_notify_smtp_from=backups@example.com \
-#     -e '{"dbbackup_notify_smtp_to": ["admin@example.com", "dba@example.com"]}'
-#
-#   # With Slack notifications
-#   ansible-playbook -i inventory with-notifications.yml \
-#     -e dbbackup_notify_slack_enabled=true \
-#     -e dbbackup_notify_slack_webhook=https://hooks.slack.com/services/XXX
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy
-#   ✗ No Prometheus exporter
-#   ✓ Email notifications (optional)
-#   ✓ Webhook/Slack notifications (optional)
-
-- name: Deploy dbbackup with notifications
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: false
-    dbbackup_notify_enabled: true
-    # Enable one or more notification methods:
-    # dbbackup_notify_smtp_enabled: true
-    # dbbackup_notify_webhook_enabled: true
-    # dbbackup_notify_slack_enabled: true
-  
-  pre_tasks:
-    - name: Validate notification configuration
-      assert:
-        that:
-          - dbbackup_notify_smtp_enabled or dbbackup_notify_webhook_enabled or dbbackup_notify_slack_enabled
-        fail_msg: "At least one notification method must be enabled"
-        success_msg: "Notification configuration valid"
-
-    - name: Validate SMTP configuration
-      assert:
-        that:
-          - dbbackup_notify_smtp_host != ''
-          - dbbackup_notify_smtp_from != ''
-          - dbbackup_notify_smtp_to | length > 0
-        fail_msg: "SMTP configuration incomplete"
-      when: dbbackup_notify_smtp_enabled | default(false)
-
-    - name: Validate webhook configuration
-      assert:
-        that:
-          - dbbackup_notify_webhook_url != ''
-        fail_msg: "Webhook URL required"
-      when: dbbackup_notify_webhook_enabled | default(false)
-
-    - name: Validate Slack configuration
-      assert:
-        that:
-          - dbbackup_notify_slack_webhook != ''
-        fail_msg: "Slack webhook URL required"
-      when: dbbackup_notify_slack_enabled | default(false)
-
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Display notification configuration
-      debug:
-        msg: |
-          Notifications configured:
-          {% if dbbackup_notify_smtp_enabled | default(false) %}
-          - SMTP: {{ dbbackup_notify_smtp_to | join(', ') }}
-          {% endif %}
-          {% if dbbackup_notify_webhook_enabled | default(false) %}
-          - Webhook: {{ dbbackup_notify_webhook_url }}
-          {% endif %}
-          {% if dbbackup_notify_slack_enabled | default(false) %}
-          - Slack: Enabled
-          {% endif %}

deploy/kubernetes/README.md

@@ -1,38 +0,0 @@
-# dbbackup Kubernetes Deployment
-
-Kubernetes manifests for running dbbackup as scheduled CronJobs.
-
-## Quick Start
-
-```bash
-# Create namespace
-kubectl create namespace dbbackup
-
-# Create secrets
-kubectl create secret generic dbbackup-db-credentials \
-  --namespace dbbackup \
-  --from-literal=password=your-db-password
-
-# Apply manifests
-kubectl apply -f . --namespace dbbackup
-
-# Check CronJob
-kubectl get cronjobs -n dbbackup
-```
-
-## Components
-
-- `configmap.yaml` - Configuration settings
-- `secret.yaml` - Credentials template (use kubectl create secret instead)
-- `cronjob.yaml` - Scheduled backup job
-- `pvc.yaml` - Persistent volume for backup storage
-- `servicemonitor.yaml` - Prometheus ServiceMonitor (optional)
-
-## Customization
-
-Edit `configmap.yaml` to configure:
-- Database connection
-- Backup schedule
-- Retention policy
-- Cloud storage
-

deploy/kubernetes/configmap.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: dbbackup-config
-  labels:
-    app: dbbackup
-data:
-  # Database Configuration
-  DB_TYPE: "postgres"
-  DB_HOST: "postgres.default.svc.cluster.local"
-  DB_PORT: "5432"
-  DB_USER: "postgres"
-  
-  # Backup Configuration
-  BACKUP_DIR: "/backups"
-  COMPRESSION: "6"
-  
-  # Retention
-  RETENTION_DAYS: "30"
-  MIN_BACKUPS: "5"
-  
-  # GFS Retention (enterprise)
-  GFS_ENABLED: "false"
-  GFS_DAILY: "7"
-  GFS_WEEKLY: "4"
-  GFS_MONTHLY: "12"
-  GFS_YEARLY: "3"

deploy/kubernetes/cronjob.yaml

@@ -1,140 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dbbackup-cluster
-  labels:
-    app: dbbackup
-    component: backup
-spec:
-  # Daily at 2:00 AM UTC
-  schedule: "0 2 * * *"
-  
-  # Keep last 3 successful and 1 failed job
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 1
-  
-  # Don't run if previous job is still running
-  concurrencyPolicy: Forbid
-  
-  # Start job within 5 minutes of scheduled time or skip
-  startingDeadlineSeconds: 300
-  
-  jobTemplate:
-    spec:
-      # Retry up to 2 times on failure
-      backoffLimit: 2
-      
-      template:
-        metadata:
-          labels:
-            app: dbbackup
-            component: backup
-        spec:
-          restartPolicy: OnFailure
-          
-          # Security context
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1000
-            fsGroup: 1000
-          
-          containers:
-          - name: dbbackup
-            image: git.uuxo.net/uuxo/dbbackup:latest
-            imagePullPolicy: IfNotPresent
-            
-            args:
-              - backup
-              - cluster
-              - --compression
-              - "$(COMPRESSION)"
-            
-            envFrom:
-              - configMapRef:
-                  name: dbbackup-config
-              - secretRef:
-                  name: dbbackup-secrets
-            
-            env:
-              - name: BACKUP_DIR
-                value: /backups
-            
-            volumeMounts:
-              - name: backup-storage
-                mountPath: /backups
-            
-            resources:
-              requests:
-                memory: "256Mi"
-                cpu: "100m"
-              limits:
-                memory: "2Gi"
-                cpu: "2000m"
-          
-          volumes:
-            - name: backup-storage
-              persistentVolumeClaim:
-                claimName: dbbackup-storage
-
----
-# Cleanup CronJob - runs weekly
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dbbackup-cleanup
-  labels:
-    app: dbbackup
-    component: cleanup
-spec:
-  # Weekly on Sunday at 3:00 AM UTC
-  schedule: "0 3 * * 0"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 1
-  concurrencyPolicy: Forbid
-  
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: dbbackup
-            component: cleanup
-        spec:
-          restartPolicy: OnFailure
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1000
-            fsGroup: 1000
-          
-          containers:
-          - name: dbbackup
-            image: git.uuxo.net/uuxo/dbbackup:latest
-            
-            args:
-              - cleanup
-              - /backups
-              - --retention-days
-              - "$(RETENTION_DAYS)"
-              - --min-backups
-              - "$(MIN_BACKUPS)"
-            
-            envFrom:
-              - configMapRef:
-                  name: dbbackup-config
-            
-            volumeMounts:
-              - name: backup-storage
-                mountPath: /backups
-            
-            resources:
-              requests:
-                memory: "128Mi"
-                cpu: "50m"
-              limits:
-                memory: "512Mi"
-                cpu: "500m"
-          
-          volumes:
-            - name: backup-storage
-              persistentVolumeClaim:
-                claimName: dbbackup-storage

deploy/kubernetes/pvc.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: dbbackup-storage
-  labels:
-    app: dbbackup
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Gi  # Adjust based on database size
-  # storageClassName: fast-ssd  # Uncomment for specific storage class

deploy/kubernetes/secret.yaml.example

@@ -1,27 +0,0 @@
-# dbbackup Secrets Template
-# DO NOT commit this file with real credentials!
-# Use: kubectl create secret generic dbbackup-secrets --from-literal=...
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: dbbackup-secrets
-  labels:
-    app: dbbackup
-type: Opaque
-stringData:
-  # Database Password (required)
-  PGPASSWORD: "CHANGE_ME"
-  
-  # Encryption Key (optional - 32+ characters recommended)
-  # DBBACKUP_ENCRYPTION_KEY: "your-encryption-key-here"
-  
-  # Cloud Storage Credentials (optional)
-  # AWS_ACCESS_KEY_ID: "AKIAXXXXXXXX"
-  # AWS_SECRET_ACCESS_KEY: "your-secret-key"
-  
-  # SMTP Notifications (optional)
-  # NOTIFY_SMTP_PASSWORD: "smtp-password"
-  
-  # Webhook Secret (optional)
-  # NOTIFY_WEBHOOK_SECRET: "hmac-signing-secret"

deploy/kubernetes/servicemonitor.yaml

@@ -1,114 +0,0 @@
-# Prometheus ServiceMonitor for dbbackup
-# Requires prometheus-operator
-
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: dbbackup
-  labels:
-    app: dbbackup
-    release: prometheus  # Match your Prometheus operator release
-spec:
-  selector:
-    matchLabels:
-      app: dbbackup
-      component: exporter
-  endpoints:
-    - port: metrics
-      interval: 60s
-      path: /metrics
-  namespaceSelector:
-    matchNames:
-      - dbbackup
-
----
-# Metrics exporter deployment (optional - for continuous metrics)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dbbackup-exporter
-  labels:
-    app: dbbackup
-    component: exporter
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dbbackup
-      component: exporter
-  template:
-    metadata:
-      labels:
-        app: dbbackup
-        component: exporter
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-      
-      containers:
-      - name: exporter
-        image: git.uuxo.net/uuxo/dbbackup:latest
-        args:
-          - metrics
-          - serve
-          - --port
-          - "9399"
-        
-        ports:
-          - name: metrics
-            containerPort: 9399
-            protocol: TCP
-        
-        envFrom:
-          - configMapRef:
-              name: dbbackup-config
-        
-        volumeMounts:
-          - name: backup-storage
-            mountPath: /backups
-            readOnly: true
-        
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: metrics
-          initialDelaySeconds: 10
-          periodSeconds: 30
-        
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: metrics
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "10m"
-          limits:
-            memory: "128Mi"
-            cpu: "100m"
-      
-      volumes:
-        - name: backup-storage
-          persistentVolumeClaim:
-            claimName: dbbackup-storage
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dbbackup-exporter
-  labels:
-    app: dbbackup
-    component: exporter
-spec:
-  ports:
-    - name: metrics
-      port: 9399
-      targetPort: metrics
-  selector:
-    app: dbbackup
-    component: exporter

deploy/prometheus/alerting-rules.yaml

@@ -1,168 +0,0 @@
-# Prometheus Alerting Rules for dbbackup
-# Import into your Prometheus/Alertmanager configuration
-
-groups:
-  - name: dbbackup
-    rules:
-      # RPO Alerts - Recovery Point Objective violations
-      - alert: DBBackupRPOWarning
-        expr: dbbackup_rpo_seconds > 43200  # 12 hours
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Database backup RPO warning on {{ $labels.server }}"
-          description: "No successful backup for {{ $labels.database }} in {{ $value | humanizeDuration }}. RPO threshold: 12 hours."
-
-      - alert: DBBackupRPOCritical
-        expr: dbbackup_rpo_seconds > 86400  # 24 hours
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Database backup RPO critical on {{ $labels.server }}"
-          description: "No successful backup for {{ $labels.database }} in {{ $value | humanizeDuration }}. Immediate attention required!"
-          runbook_url: "https://wiki.example.com/runbooks/dbbackup-rpo-violation"
-
-      # Backup Failure Alerts
-      - alert: DBBackupFailed
-        expr: increase(dbbackup_backup_total{status="failure"}[1h]) > 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Database backup failed on {{ $labels.server }}"
-          description: "Backup for {{ $labels.database }} failed. Check logs for details."
-
-      - alert: DBBackupFailureRateHigh
-        expr: |
-          rate(dbbackup_backup_total{status="failure"}[24h]) 
-          / 
-          rate(dbbackup_backup_total[24h]) > 0.1
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "High backup failure rate on {{ $labels.server }}"
-          description: "More than 10% of backups are failing over the last 24 hours."
-
-      # Backup Size Anomalies
-      - alert: DBBackupSizeAnomaly
-        expr: |
-          abs(
-            dbbackup_last_backup_size_bytes 
-            - avg_over_time(dbbackup_last_backup_size_bytes[7d])
-          ) 
-          / avg_over_time(dbbackup_last_backup_size_bytes[7d]) > 0.5
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup size anomaly for {{ $labels.database }}"
-          description: "Backup size changed by more than 50% compared to 7-day average. Current: {{ $value | humanize1024 }}B"
-
-      - alert: DBBackupSizeZero
-        expr: dbbackup_last_backup_size_bytes == 0
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Zero-size backup detected for {{ $labels.database }}"
-          description: "Last backup file is empty. Backup likely failed silently."
-
-      # Duration Alerts
-      - alert: DBBackupDurationHigh
-        expr: dbbackup_last_backup_duration_seconds > 3600  # 1 hour
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup taking too long for {{ $labels.database }}"
-          description: "Last backup took {{ $value | humanizeDuration }}. Consider optimizing backup strategy."
-
-      # Verification Alerts
-      - alert: DBBackupNotVerified
-        expr: dbbackup_backup_verified == 0
-        for: 24h
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup not verified for {{ $labels.database }}"
-          description: "Last backup was not verified. Run dbbackup verify to check integrity."
-
-      # PITR Alerts
-      - alert: DBBackupPITRArchiveLag
-        expr: dbbackup_pitr_archive_lag_seconds > 600
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR archive lag on {{ $labels.server }}"
-          description: "WAL/binlog archiving for {{ $labels.database }} is {{ $value | humanizeDuration }} behind."
-
-      - alert: DBBackupPITRArchiveCritical
-        expr: dbbackup_pitr_archive_lag_seconds > 1800
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR archive critically behind on {{ $labels.server }}"
-          description: "WAL/binlog archiving for {{ $labels.database }} is {{ $value | humanizeDuration }} behind. PITR capability at risk!"
-
-      - alert: DBBackupPITRChainBroken
-        expr: dbbackup_pitr_chain_valid == 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR chain broken for {{ $labels.database }}"
-          description: "WAL/binlog chain has gaps. Point-in-time recovery NOT possible. New base backup required."
-
-      - alert: DBBackupPITRGaps
-        expr: dbbackup_pitr_gap_count > 0
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR chain gaps for {{ $labels.database }}"
-          description: "{{ $value }} gaps in WAL/binlog chain. Recovery to points within gaps will fail."
-
-      # Backup Type Alerts
-      - alert: DBBackupNoRecentFull
-        expr: time() - dbbackup_last_success_timestamp{backup_type="full"} > 604800
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "No full backup in 7+ days for {{ $labels.database }}"
-          description: "Consider taking a full backup. Incremental chains depend on valid base."
-
-      # Exporter Health
-      - alert: DBBackupExporterDown
-        expr: up{job="dbbackup"} == 0
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "dbbackup exporter is down on {{ $labels.instance }}"
-          description: "Cannot scrape metrics from dbbackup exporter. Monitoring is impaired."
-
-      # Deduplication Alerts
-      - alert: DBBackupDedupRatioLow
-        expr: dbbackup_dedup_ratio < 0.2
-        for: 24h
-        labels:
-          severity: info
-        annotations:
-          summary: "Low deduplication ratio on {{ $labels.server }}"
-          description: "Dedup ratio is {{ $value | printf \"%.1f%%\" }}. Consider if dedup is beneficial."
-
-      # Storage Alerts
-      - alert: DBBackupStorageHigh
-        expr: dbbackup_dedup_disk_usage_bytes > 1099511627776  # 1 TB
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "High backup storage usage on {{ $labels.server }}"
-          description: "Backup storage using {{ $value | humanize1024 }}B. Review retention policy."

deploy/prometheus/scrape-config.yaml

@@ -1,48 +0,0 @@
-# Prometheus scrape configuration for dbbackup
-# Add to your prometheus.yml
-
-scrape_configs:
-  - job_name: 'dbbackup'
-    # Scrape interval - backup metrics don't change frequently
-    scrape_interval: 60s
-    scrape_timeout: 10s
-    
-    # Static targets - list your database servers
-    static_configs:
-      - targets:
-          - 'db-server-01:9399'
-          - 'db-server-02:9399'
-          - 'db-server-03:9399'
-        labels:
-          environment: 'production'
-      
-      - targets:
-          - 'db-staging:9399'
-        labels:
-          environment: 'staging'
-    
-    # Relabeling (optional)
-    relabel_configs:
-      # Extract hostname from target
-      - source_labels: [__address__]
-        target_label: instance
-        regex: '([^:]+):\d+'
-        replacement: '$1'
-
-# Alternative: File-based service discovery
-# Useful when targets are managed by Ansible/Terraform
-
-  - job_name: 'dbbackup-sd'
-    scrape_interval: 60s
-    file_sd_configs:
-      - files:
-          - '/etc/prometheus/targets/dbbackup/*.yml'
-        refresh_interval: 5m
-
-# Example target file (/etc/prometheus/targets/dbbackup/production.yml):
-# - targets:
-#     - db-server-01:9399
-#     - db-server-02:9399
-#   labels:
-#     environment: production
-#     datacenter: us-east-1

deploy/scripts/backup-rotation.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Backup Rotation Script for dbbackup
-# Implements GFS (Grandfather-Father-Son) retention policy
-#
-# Usage: backup-rotation.sh /path/to/backups [--dry-run]
-
-set -euo pipefail
-
-BACKUP_DIR="${1:-/var/backups/databases}"
-DRY_RUN="${2:-}"
-
-# GFS Configuration
-DAILY_KEEP=7
-WEEKLY_KEEP=4
-MONTHLY_KEEP=12
-YEARLY_KEEP=3
-
-# Minimum backups to always keep
-MIN_BACKUPS=5
-
-echo "═══════════════════════════════════════════════════════════════"
-echo "  dbbackup GFS Rotation"
-echo "═══════════════════════════════════════════════════════════════"
-echo ""
-echo "  Backup Directory: $BACKUP_DIR"
-echo "  Retention Policy:"
-echo "    Daily:   $DAILY_KEEP backups"
-echo "    Weekly:  $WEEKLY_KEEP backups"  
-echo "    Monthly: $MONTHLY_KEEP backups"
-echo "    Yearly:  $YEARLY_KEEP backups"
-echo ""
-
-if [[ "$DRY_RUN" == "--dry-run" ]]; then
-    echo "  [DRY RUN MODE - No files will be deleted]"
-    echo ""
-fi
-
-# Check if dbbackup is available
-if ! command -v dbbackup &> /dev/null; then
-    echo "ERROR: dbbackup command not found"
-    exit 1
-fi
-
-# Build cleanup command
-CLEANUP_CMD="dbbackup cleanup $BACKUP_DIR \
-    --gfs \
-    --gfs-daily $DAILY_KEEP \
-    --gfs-weekly $WEEKLY_KEEP \
-    --gfs-monthly $MONTHLY_KEEP \
-    --gfs-yearly $YEARLY_KEEP \
-    --min-backups $MIN_BACKUPS"
-
-if [[ "$DRY_RUN" == "--dry-run" ]]; then
-    CLEANUP_CMD="$CLEANUP_CMD --dry-run"
-fi
-
-echo "Running: $CLEANUP_CMD"
-echo ""
-
-$CLEANUP_CMD
-
-echo ""
-echo "═══════════════════════════════════════════════════════════════"
-echo "  Rotation complete"
-echo "═══════════════════════════════════════════════════════════════"

deploy/scripts/health-check.sh

@@ -1,92 +0,0 @@
-#!/bin/bash
-# Health Check Script for dbbackup
-# Returns exit codes for monitoring systems:
-#   0 = OK (backup within RPO)
-#   1 = WARNING (backup older than warning threshold)
-#   2 = CRITICAL (backup older than critical threshold or missing)
-#
-# Usage: health-check.sh [backup-dir] [warning-hours] [critical-hours]
-
-set -euo pipefail
-
-BACKUP_DIR="${1:-/var/backups/databases}"
-WARNING_HOURS="${2:-24}"
-CRITICAL_HOURS="${3:-48}"
-
-# Convert to seconds
-WARNING_SECONDS=$((WARNING_HOURS * 3600))
-CRITICAL_SECONDS=$((CRITICAL_HOURS * 3600))
-
-echo "dbbackup Health Check"
-echo "====================="
-echo "Backup directory: $BACKUP_DIR"
-echo "Warning threshold: ${WARNING_HOURS}h"
-echo "Critical threshold: ${CRITICAL_HOURS}h"
-echo ""
-
-# Check if backup directory exists
-if [[ ! -d "$BACKUP_DIR" ]]; then
-    echo "CRITICAL: Backup directory does not exist"
-    exit 2
-fi
-
-# Find most recent backup file
-LATEST_BACKUP=$(find "$BACKUP_DIR" -type f \( -name "*.dump" -o -name "*.dump.gz" -o -name "*.sql" -o -name "*.sql.gz" -o -name "*.tar.gz" \) -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1)
-
-if [[ -z "$LATEST_BACKUP" ]]; then
-    echo "CRITICAL: No backup files found in $BACKUP_DIR"
-    exit 2
-fi
-
-# Extract timestamp and path
-BACKUP_TIMESTAMP=$(echo "$LATEST_BACKUP" | cut -d' ' -f1 | cut -d'.' -f1)
-BACKUP_PATH=$(echo "$LATEST_BACKUP" | cut -d' ' -f2-)
-BACKUP_NAME=$(basename "$BACKUP_PATH")
-
-# Calculate age
-NOW=$(date +%s)
-AGE_SECONDS=$((NOW - BACKUP_TIMESTAMP))
-AGE_HOURS=$((AGE_SECONDS / 3600))
-AGE_DAYS=$((AGE_HOURS / 24))
-
-# Format age string
-if [[ $AGE_DAYS -gt 0 ]]; then
-    AGE_STR="${AGE_DAYS}d $((AGE_HOURS % 24))h"
-else
-    AGE_STR="${AGE_HOURS}h $((AGE_SECONDS % 3600 / 60))m"
-fi
-
-# Get backup size
-BACKUP_SIZE=$(du -h "$BACKUP_PATH" 2>/dev/null | cut -f1)
-
-echo "Latest backup:"
-echo "  File: $BACKUP_NAME"
-echo "  Size: $BACKUP_SIZE"
-echo "  Age:  $AGE_STR"
-echo ""
-
-# Verify backup integrity if dbbackup is available
-if command -v dbbackup &> /dev/null; then
-    echo "Verifying backup integrity..."
-    if dbbackup verify "$BACKUP_PATH" --quiet 2>/dev/null; then
-        echo "  ✓ Backup integrity verified"
-    else
-        echo "  ✗ Backup verification failed"
-        echo ""
-        echo "CRITICAL: Latest backup is corrupted"
-        exit 2
-    fi
-    echo ""
-fi
-
-# Check thresholds
-if [[ $AGE_SECONDS -ge $CRITICAL_SECONDS ]]; then
-    echo "CRITICAL: Last backup is ${AGE_STR} old (threshold: ${CRITICAL_HOURS}h)"
-    exit 2
-elif [[ $AGE_SECONDS -ge $WARNING_SECONDS ]]; then
-    echo "WARNING: Last backup is ${AGE_STR} old (threshold: ${WARNING_HOURS}h)"
-    exit 1
-else
-    echo "OK: Last backup is ${AGE_STR} old"
-    exit 0
-fi

deploy/terraform/aws/example.tf

@@ -1,26 +0,0 @@
-# dbbackup Terraform - AWS Example
-
-variable "aws_region" {
-  default = "us-east-1"
-}
-
-provider "aws" {
-  region = var.aws_region
-}
-
-module "dbbackup_storage" {
-  source = "./main.tf"
-  
-  environment    = "production"
-  bucket_name    = "mycompany-database-backups"
-  retention_days = 30
-  glacier_days   = 365
-}
-
-output "bucket_name" {
-  value = module.dbbackup_storage.bucket_name
-}
-
-output "setup_instructions" {
-  value = module.dbbackup_storage.dbbackup_cloud_config
-}

deploy/terraform/aws/main.tf

@@ -1,202 +0,0 @@
-# dbbackup Terraform Module - AWS Deployment
-# Creates S3 bucket for backup storage with proper security
-
-terraform {
-  required_version = ">= 1.0"
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 4.0"
-    }
-  }
-}
-
-# Variables
-variable "environment" {
-  description = "Environment name (e.g., production, staging)"
-  type        = string
-  default     = "production"
-}
-
-variable "bucket_name" {
-  description = "S3 bucket name for backups"
-  type        = string
-}
-
-variable "retention_days" {
-  description = "Days to keep backups before transitioning to Glacier"
-  type        = number
-  default     = 30
-}
-
-variable "glacier_days" {
-  description = "Days to keep in Glacier before deletion (0 = keep forever)"
-  type        = number
-  default     = 365
-}
-
-variable "enable_encryption" {
-  description = "Enable server-side encryption"
-  type        = bool
-  default     = true
-}
-
-variable "kms_key_arn" {
-  description = "KMS key ARN for encryption (leave empty for aws/s3 managed key)"
-  type        = string
-  default     = ""
-}
-
-# S3 Bucket
-resource "aws_s3_bucket" "backups" {
-  bucket = var.bucket_name
-  
-  tags = {
-    Name        = "Database Backups"
-    Environment = var.environment
-    ManagedBy   = "terraform"
-    Application = "dbbackup"
-  }
-}
-
-# Versioning
-resource "aws_s3_bucket_versioning" "backups" {
-  bucket = aws_s3_bucket.backups.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-# Encryption
-resource "aws_s3_bucket_server_side_encryption_configuration" "backups" {
-  count  = var.enable_encryption ? 1 : 0
-  bucket = aws_s3_bucket.backups.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm     = var.kms_key_arn != "" ? "aws:kms" : "AES256"
-      kms_master_key_id = var.kms_key_arn != "" ? var.kms_key_arn : null
-    }
-    bucket_key_enabled = true
-  }
-}
-
-# Lifecycle Rules
-resource "aws_s3_bucket_lifecycle_configuration" "backups" {
-  bucket = aws_s3_bucket.backups.id
-
-  rule {
-    id     = "transition-to-glacier"
-    status = "Enabled"
-
-    filter {
-      prefix = ""
-    }
-
-    transition {
-      days          = var.retention_days
-      storage_class = "GLACIER"
-    }
-
-    dynamic "expiration" {
-      for_each = var.glacier_days > 0 ? [1] : []
-      content {
-        days = var.retention_days + var.glacier_days
-      }
-    }
-
-    noncurrent_version_transition {
-      noncurrent_days = 30
-      storage_class   = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      noncurrent_days = 90
-    }
-  }
-}
-
-# Block Public Access
-resource "aws_s3_bucket_public_access_block" "backups" {
-  bucket = aws_s3_bucket.backups.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-# IAM User for dbbackup
-resource "aws_iam_user" "dbbackup" {
-  name = "dbbackup-${var.environment}"
-  path = "/service-accounts/"
-  
-  tags = {
-    Application = "dbbackup"
-    Environment = var.environment
-  }
-}
-
-resource "aws_iam_access_key" "dbbackup" {
-  user = aws_iam_user.dbbackup.name
-}
-
-# IAM Policy
-resource "aws_iam_user_policy" "dbbackup" {
-  name = "dbbackup-s3-access"
-  user = aws_iam_user.dbbackup.name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:PutObject",
-          "s3:DeleteObject",
-          "s3:ListBucket",
-          "s3:GetBucketLocation"
-        ]
-        Resource = [
-          aws_s3_bucket.backups.arn,
-          "${aws_s3_bucket.backups.arn}/*"
-        ]
-      }
-    ]
-  })
-}
-
-# Outputs
-output "bucket_name" {
-  description = "S3 bucket name"
-  value       = aws_s3_bucket.backups.id
-}
-
-output "bucket_arn" {
-  description = "S3 bucket ARN"
-  value       = aws_s3_bucket.backups.arn
-}
-
-output "access_key_id" {
-  description = "IAM access key ID for dbbackup"
-  value       = aws_iam_access_key.dbbackup.id
-}
-
-output "secret_access_key" {
-  description = "IAM secret access key for dbbackup"
-  value       = aws_iam_access_key.dbbackup.secret
-  sensitive   = true
-}
-
-output "dbbackup_cloud_config" {
-  description = "Cloud configuration for dbbackup"
-  value       = <<-EOT
-    # Add to dbbackup environment:
-    export AWS_ACCESS_KEY_ID="${aws_iam_access_key.dbbackup.id}"
-    export AWS_SECRET_ACCESS_KEY="<run: terraform output -raw secret_access_key>"
-    
-    # Use with dbbackup:
-    dbbackup backup cluster --cloud s3://${aws_s3_bucket.backups.id}/backups/
-  EOT
-}

docs/CATALOG.md

@@ -1,339 +0,0 @@
-# Backup Catalog
-
-Complete reference for the dbbackup catalog system for tracking, managing, and analyzing backup inventory.
-
-## Overview
-
-The catalog is a SQLite database that tracks all backups, providing:
-- Backup gap detection (missing scheduled backups)
-- Retention policy compliance verification
-- Backup integrity tracking
-- Historical retention enforcement
-- Full-text search over backup metadata
-
-## Quick Start
-
-```bash
-# Initialize catalog (automatic on first use)
-dbbackup catalog sync /mnt/backups/databases
-
-# List all backups in catalog
-dbbackup catalog list
-
-# Show catalog statistics
-dbbackup catalog stats
-
-# View backup details
-dbbackup catalog info mydb_2026-01-23.dump.gz
-
-# Search for backups
-dbbackup catalog search --database myapp --after 2026-01-01
-```
-
-## Catalog Sync
-
-Syncs local backup directory with catalog database.
-
-```bash
-# Sync all backups in directory
-dbbackup catalog sync /mnt/backups/databases
-
-# Force rescan (useful if backups were added manually)
-dbbackup catalog sync /mnt/backups/databases --force
-
-# Sync specific database backups
-dbbackup catalog sync /mnt/backups/databases --database myapp
-
-# Dry-run to see what would be synced
-dbbackup catalog sync /mnt/backups/databases --dry-run
-```
-
-Catalog entries include:
-- Backup filename
-- Database name
-- Backup timestamp
-- Size (bytes)
-- Compression ratio
-- Encryption status
-- Backup type (full/incremental/pitr_base)
-- Retention status
-- Checksum/hash
-
-## Listing Backups
-
-### Show All Backups
-
-```bash
-dbbackup catalog list
-```
-
-Output format:
-```
-Database        Timestamp            Size        Compressed  Encrypted  Verified  Type
-myapp           2026-01-23 14:30:00  2.5 GB      62%         yes        yes       full
-myapp           2026-01-23 02:00:00  1.2 GB      58%         yes        yes       incremental
-mydb            2026-01-23 22:15:00  856 MB      64%         no         no        full
-```
-
-### Filter by Database
-
-```bash
-dbbackup catalog list --database myapp
-```
-
-### Filter by Date Range
-
-```bash
-dbbackup catalog list --after 2026-01-01 --before 2026-01-31
-```
-
-### Sort Results
-
-```bash
-dbbackup catalog list --sort size --reverse     # Largest first
-dbbackup catalog list --sort date              # Oldest first
-dbbackup catalog list --sort verified           # Verified first
-```
-
-## Statistics and Gaps
-
-### Show Catalog Statistics
-
-```bash
-dbbackup catalog stats
-```
-
-Output includes:
-- Total backups
-- Total size stored
-- Unique databases
-- Success/failure ratio
-- Oldest/newest backup
-- Average backup size
-
-### Detect Backup Gaps
-
-Gaps are missing expected backups based on schedule.
-
-```bash
-# Show gaps in mydb backups (assuming daily schedule)
-dbbackup catalog gaps mydb --interval 24h
-
-# 12-hour interval
-dbbackup catalog gaps mydb --interval 12h
-
-# Show as calendar grid
-dbbackup catalog gaps mydb --interval 24h --calendar
-
-# Define custom work hours (backup only weekdays 02:00)
-dbbackup catalog gaps mydb --interval 24h --workdays-only
-```
-
-Output shows:
-- Dates with missing backups
-- Expected backup count
-- Actual backup count
-- Gap duration
-- Reasons (if known)
-
-## Searching
-
-Full-text search across backup metadata.
-
-```bash
-# Search by database name
-dbbackup catalog search --database myapp
-
-# Search by date
-dbbackup catalog search --after 2026-01-01 --before 2026-01-31
-
-# Search by size range (GB)
-dbbackup catalog search --min-size 0.5 --max-size 5.0
-
-# Search by backup type
-dbbackup catalog search --backup-type incremental
-
-# Search by encryption status
-dbbackup catalog search --encrypted
-
-# Search by verification status
-dbbackup catalog search --verified
-
-# Combine filters
-dbbackup catalog search --database myapp --encrypted --after 2026-01-01
-```
-
-## Backup Details
-
-```bash
-# Show full details for a specific backup
-dbbackup catalog info mydb_2026-01-23.dump.gz
-
-# Output includes:
-#   - Filename and path
-#   - Database name and version
-#   - Backup timestamp
-#   - Backup type (full/incremental/pitr_base)
-#   - Size (compressed/uncompressed)
-#   - Compression ratio
-#   - Encryption (algorithm, key hash)
-#   - Checksums (md5, sha256)
-#   - Verification status and date
-#   - Retention classification (daily/weekly/monthly)
-#   - Comments/notes
-```
-
-## Retention Classification
-
-The catalog classifies backups according to retention policies.
-
-### GFS (Grandfather-Father-Son) Classification
-
-```
-Daily:   Last 7 backups
-Weekly:  One backup per week for 4 weeks
-Monthly: One backup per month for 12 months
-```
-
-Example:
-```bash
-dbbackup catalog list --show-retention
-
-# Output shows:
-# myapp_2026-01-23.dump.gz  daily    (retain 6 more days)
-# myapp_2026-01-16.dump.gz  weekly   (retain 3 more weeks)
-# myapp_2026-01-01.dump.gz  monthly  (retain 11 more months)
-```
-
-## Compliance Reports
-
-Generate compliance reports based on catalog data.
-
-```bash
-# Backup compliance report
-dbbackup catalog compliance-report
-
-# Shows:
-# - All backups compliant with retention policy
-# - Gaps exceeding SLA
-# - Failed backups
-# - Unverified backups
-# - Encryption status
-```
-
-## Configuration
-
-Catalog settings in `.dbbackup.conf`:
-
-```ini
-[catalog]
-# Enable catalog (default: true)
-enabled = true
-
-# Catalog database path (default: ~/.dbbackup/catalog.db)
-db_path = /var/lib/dbbackup/catalog.db
-
-# Retention days (default: 30)
-retention_days = 30
-
-# Minimum backups to keep (default: 5)
-min_backups = 5
-
-# Enable gap detection (default: true)
-gap_detection = true
-
-# Gap alert threshold (hours, default: 36)
-gap_threshold_hours = 36
-
-# Verify backups automatically (default: true)
-auto_verify = true
-```
-
-## Maintenance
-
-### Rebuild Catalog
-
-Rebuild from scratch (useful if corrupted):
-
-```bash
-dbbackup catalog rebuild /mnt/backups/databases
-```
-
-### Export Catalog
-
-Export to CSV for analysis in spreadsheet/BI tools:
-
-```bash
-dbbackup catalog export --format csv --output catalog.csv
-```
-
-Supported formats:
-- csv (Excel compatible)
-- json (structured data)
-- html (browseable report)
-
-### Cleanup Orphaned Entries
-
-Remove catalog entries for deleted backups:
-
-```bash
-dbbackup catalog cleanup --orphaned
-
-# Dry-run
-dbbackup catalog cleanup --orphaned --dry-run
-```
-
-## Examples
-
-### Find All Encrypted Backups from Last Week
-
-```bash
-dbbackup catalog search \
-  --after "$(date -d '7 days ago' +%Y-%m-%d)" \
-  --encrypted
-```
-
-### Generate Weekly Compliance Report
-
-```bash
-dbbackup catalog search \
-  --after "$(date -d '7 days ago' +%Y-%m-%d)" \
-  --show-retention \
-  --verified
-```
-
-### Monitor Backup Size Growth
-
-```bash
-dbbackup catalog stats | grep "Average backup size"
-
-# Track over time
-for week in $(seq 1 4); do
-  DATE=$(date -d "$((week*7)) days ago" +%Y-%m-%d)
-  echo "Week of $DATE:"
-  dbbackup catalog stats --after "$DATE" | grep "Average backup size"
-done
-```
-
-## Troubleshooting
-
-### Catalog Shows Wrong Count
-
-Resync the catalog:
-```bash
-dbbackup catalog sync /mnt/backups/databases --force
-```
-
-### Gaps Detected But Backups Exist
-
-Manual backups not in catalog - sync them:
-```bash
-dbbackup catalog sync /mnt/backups/databases
-```
-
-### Corruption Error
-
-Rebuild catalog:
-```bash
-dbbackup catalog rebuild /mnt/backups/databases
-```

docs/COMPARISON.md

@@ -1,83 +0,0 @@
-# dbbackup vs. Competing Solutions
-
-## Feature Comparison Matrix
-
-| Feature | dbbackup | pgBackRest | Barman |
-|---------|----------|------------|--------|
-| Native Engines | YES | NO | NO |
-| Multi-DB Support | YES | NO | NO |
-| Interactive TUI | YES | NO | NO |
-| DR Drill Testing | YES | NO | NO |
-| Compliance Reports | YES | NO | NO |
-| Cloud Storage | YES | YES | LIMITED |
-| Point-in-Time Recovery | YES | YES | YES |
-| Incremental Backups | DEDUP | YES | YES |
-| Parallel Processing | YES | YES | LIMITED |
-| Cross-Platform | YES | LINUX-ONLY | LINUX-ONLY |
-| MySQL Support | YES | NO | NO |
-| Prometheus Metrics | YES | LIMITED | NO |
-| Enterprise Encryption | YES | YES | YES |
-| Active Development | YES | YES | LIMITED |
-| Learning Curve | LOW | HIGH | HIGH |
-
-## Key Differentiators
-
-### Native Database Engines
-- **dbbackup**: Custom Go implementations for optimal performance
-- **pgBackRest**: Relies on PostgreSQL's native tools
-- **Barman**: Wrapper around pg_dump/pg_basebackup
-
-### Multi-Database Support  
-- **dbbackup**: PostgreSQL and MySQL in single tool
-- **pgBackRest**: PostgreSQL only
-- **Barman**: PostgreSQL only
-
-### User Experience
-- **dbbackup**: Modern TUI, shell completion, comprehensive docs
-- **pgBackRest**: Command-line configuration-heavy
-- **Barman**: Traditional Unix-style interface
-
-### Disaster Recovery Testing
-- **dbbackup**: Built-in drill command with automated validation
-- **pgBackRest**: Manual verification process
-- **Barman**: Manual verification process
-
-### Compliance and Reporting
-- **dbbackup**: Automated compliance reports, audit trails
-- **pgBackRest**: Basic logging
-- **Barman**: Basic logging
-
-## Decision Matrix
-
-### Choose dbbackup if:
-- Managing both PostgreSQL and MySQL
-- Need simplified operations with powerful features
-- Require disaster recovery testing automation
-- Want modern tooling with enterprise features
-- Operating in heterogeneous database environments
-
-### Choose pgBackRest if:
-- PostgreSQL-only environment
-- Need battle-tested incremental backup solution
-- Have dedicated PostgreSQL expertise
-- Require maximum PostgreSQL-specific optimizations
-
-### Choose Barman if:
-- Legacy PostgreSQL environments
-- Prefer traditional backup approaches
-- Have existing Barman expertise
-- Need specific Italian enterprise support
-
-## Migration Paths
-
-### From pgBackRest
-1. Test dbbackup native engine performance
-2. Compare backup/restore times
-3. Validate compliance requirements
-4. Gradual migration with parallel operation
-
-### From Barman
-1. Evaluate multi-database consolidation benefits
-2. Test TUI workflow improvements
-3. Assess disaster recovery automation gains
-4. Training on modern backup practices

docs/COVERAGE_PROGRESS.md

@@ -1,123 +0,0 @@
-# Test Coverage Progress Report
-
-## Summary
-
-Initial coverage: **7.1%**  
-Current coverage: **7.9%**
-
-## Packages Improved
-
-| Package | Before | After | Improvement |
-|---------|--------|-------|-------------|
-| `internal/exitcode` | 0.0% | **100.0%** | +100.0% |
-| `internal/errors` | 0.0% | **100.0%** | +100.0% |
-| `internal/metadata` | 0.0% | **92.2%** | +92.2% |
-| `internal/checks` | 10.2% | **20.3%** | +10.1% |
-| `internal/fs` | 9.4% | **20.9%** | +11.5% |
-
-## Packages With Good Coverage (>50%)
-
-| Package | Coverage |
-|---------|----------|
-| `internal/errors` | 100.0% |
-| `internal/exitcode` | 100.0% |
-| `internal/metadata` | 92.2% |
-| `internal/encryption` | 78.0% |
-| `internal/crypto` | 71.1% |
-| `internal/logger` | 62.7% |
-| `internal/performance` | 58.9% |
-
-## Packages Needing Attention (0% coverage)
-
-These packages have no test coverage and should be prioritized:
-
-- `cmd/*` - All command files (CLI commands)
-- `internal/auth`
-- `internal/cleanup`
-- `internal/cpu`
-- `internal/database`
-- `internal/drill`
-- `internal/engine/native`
-- `internal/engine/parallel`
-- `internal/engine/snapshot`
-- `internal/installer`
-- `internal/metrics`
-- `internal/migrate`
-- `internal/parallel`
-- `internal/prometheus`
-- `internal/replica`
-- `internal/report`
-- `internal/rto`
-- `internal/swap`
-- `internal/tui`
-- `internal/wal`
-
-## Tests Created
-
-1. **`internal/exitcode/codes_test.go`** - Comprehensive tests for exit codes
-   - Tests all exit code constants
-   - Tests `ExitWithCode()` function with various error patterns
-   - Tests `contains()` helper function
-   - Benchmarks included
-
-2. **`internal/errors/errors_test.go`** - Complete error package tests
-   - Tests all error codes and categories
-   - Tests `BackupError` struct methods (Error, Unwrap, Is)
-   - Tests all factory functions (NewConfigError, NewAuthError, etc.)
-   - Tests helper constructors (ConnectionFailed, DiskFull, etc.)
-   - Tests IsRetryable, GetCategory, GetCode functions
-   - Benchmarks included
-
-3. **`internal/metadata/metadata_test.go`** - Metadata handling tests
-   - Tests struct field initialization
-   - Tests Save/Load operations
-   - Tests CalculateSHA256
-   - Tests ListBackups
-   - Tests FormatSize
-   - JSON marshaling tests
-   - Benchmarks included
-
-4. **`internal/fs/fs_test.go`** - Extended filesystem tests
-   - Tests for SetFS, ResetFS, NewMemMapFs
-   - Tests for NewReadOnlyFs, NewBasePathFs
-   - Tests for Create, Open, OpenFile
-   - Tests for Remove, RemoveAll, Rename
-   - Tests for Stat, Chmod, Chown, Chtimes
-   - Tests for Mkdir, ReadDir, DirExists
-   - Tests for TempFile, CopyFile, FileSize
-   - Tests for SecureMkdirAll, SecureCreate, SecureOpenFile
-   - Tests for SecureMkdirTemp, CheckWriteAccess
-
-5. **`internal/checks/error_hints_test.go`** - Error classification tests
-   - Tests ClassifyError for all error categories
-   - Tests classifyErrorByPattern
-   - Tests FormatErrorWithHint
-   - Tests FormatMultipleErrors
-   - Tests formatBytes
-   - Tests DiskSpaceCheck and ErrorClassification structs
-
-## Next Steps to Reach 99%
-
-1. **cmd/ package** - Test CLI commands using mock executions
-2. **internal/database** - Database connection tests with mocks
-3. **internal/backup** - Backup logic with mocked database/filesystem
-4. **internal/restore** - Restore logic tests
-5. **internal/catalog** - Improve from 40.1%
-6. **internal/cloud** - Cloud provider tests with mocked HTTP
-7. **internal/engine/*** - Engine tests with mocked processes
-
-## Running Coverage
-
-```bash
-# Run all tests with coverage
-go test -coverprofile=coverage.out ./...
-
-# View coverage summary
-go tool cover -func=coverage.out | grep "total:"
-
-# Generate HTML report
-go tool cover -html=coverage.out -o coverage.html
-
-# Run specific package tests
-go test -v -cover ./internal/errors/
-```

docs/DRILL.md

@@ -1,365 +0,0 @@
-# Disaster Recovery Drilling
-
-Complete guide for automated disaster recovery testing with dbbackup.
-
-## Overview
-
-DR drills automate the process of validating backup integrity through actual restore testing. Instead of hoping backups work when needed, automated drills regularly restore backups in isolated containers to verify:
-
-- Backup file integrity
-- Database compatibility
-- Restore time estimates (RTO)
-- Schema validation
-- Data consistency
-
-## Quick Start
-
-```bash
-# Run single DR drill on latest backup
-dbbackup drill /mnt/backups/databases
-
-# Drill specific database
-dbbackup drill /mnt/backups/databases --database myapp
-
-# Drill multiple databases
-dbbackup drill /mnt/backups/databases --database myapp,mydb
-
-# Schedule daily drills
-dbbackup drill /mnt/backups/databases --schedule daily
-```
-
-## How It Works
-
-1. **Select backup** - Picks latest or specified backup
-2. **Create container** - Starts isolated database container
-3. **Extract backup** - Decompresses to temporary storage
-4. **Restore** - Imports data to test database
-5. **Validate** - Runs integrity checks
-6. **Cleanup** - Removes test container
-7. **Report** - Stores results in catalog
-
-## Drill Configuration
-
-### Select Specific Backup
-
-```bash
-# Latest backup for database
-dbbackup drill /mnt/backups/databases --database myapp
-
-# Backup from specific date
-dbbackup drill /mnt/backups/databases --database myapp --date 2026-01-23
-
-# Oldest backup (best test)
-dbbackup drill /mnt/backups/databases --database myapp --oldest
-```
-
-### Drill Options
-
-```bash
-# Full validation (slower)
-dbbackup drill /mnt/backups/databases --full-validation
-
-# Quick validation (schema only, faster)
-dbbackup drill /mnt/backups/databases --quick-validation
-
-# Store results in catalog
-dbbackup drill /mnt/backups/databases --catalog
-
-# Send notification on failure
-dbbackup drill /mnt/backups/databases --notify-on-failure
-
-# Custom test database name
-dbbackup drill /mnt/backups/databases --test-database dr_test_prod
-```
-
-## Scheduled Drills
-
-Run drills automatically on a schedule.
-
-### Configure Schedule
-
-```bash
-# Daily drill at 03:00
-dbbackup drill /mnt/backups/databases --schedule "03:00"
-
-# Weekly drill (Sunday 02:00)
-dbbackup drill /mnt/backups/databases --schedule "sun 02:00"
-
-# Monthly drill (1st of month)
-dbbackup drill /mnt/backups/databases --schedule "monthly"
-
-# Install as systemd timer
-sudo dbbackup install drill \
-  --backup-path /mnt/backups/databases \
-  --schedule "03:00"
-```
-
-### Verify Schedule
-
-```bash
-# Show next 5 scheduled drills
-dbbackup drill list --upcoming
-
-# Check drill history
-dbbackup drill list --history
-
-# Show drill statistics
-dbbackup drill stats
-```
-
-## Drill Results
-
-### View Drill History
-
-```bash
-# All drill results
-dbbackup drill list
-
-# Recent 10 drills
-dbbackup drill list --limit 10
-
-# Drills from last week
-dbbackup drill list --after "$(date -d '7 days ago' +%Y-%m-%d)"
-
-# Failed drills only
-dbbackup drill list --status failed
-
-# Passed drills only
-dbbackup drill list --status passed
-```
-
-### Detailed Drill Report
-
-```bash
-dbbackup drill report myapp_2026-01-23.dump.gz
-
-# Output includes:
-#   - Backup filename
-#   - Database version
-#   - Extract time
-#   - Restore time
-#   - Row counts (before/after)
-#   - Table verification results
-#   - Data integrity status
-#   - Pass/Fail verdict
-#   - Warnings/errors
-```
-
-## Validation Types
-
-### Full Validation
-
-Deep integrity checks on restored data.
-
-```bash
-dbbackup drill /mnt/backups/databases --full-validation
-
-# Checks:
-# - All tables restored
-# - Row counts match original
-# - Indexes present and valid
-# - Constraints enforced
-# - Foreign key references valid
-# - Sequence values correct (PostgreSQL)
-# - Triggers present (if not system-generated)
-```
-
-### Quick Validation
-
-Schema-only validation (fast).
-
-```bash
-dbbackup drill /mnt/backups/databases --quick-validation
-
-# Checks:
-# - Database connects
-# - All tables present
-# - Column definitions correct
-# - Indexes exist
-```
-
-### Custom Validation
-
-Run custom SQL checks.
-
-```bash
-# Add custom validation query
-dbbackup drill /mnt/backups/databases \
-  --validation-query "SELECT COUNT(*) FROM users" \
-  --validation-expected 15000
-
-# Example for multiple tables
-dbbackup drill /mnt/backups/databases \
-  --validation-query "SELECT COUNT(*) FROM orders WHERE status='completed'" \
-  --validation-expected 42000
-```
-
-## Reporting
-
-### Generate Drill Report
-
-```bash
-# HTML report (email-friendly)
-dbbackup drill report --format html --output drill-report.html
-
-# JSON report (for CI/CD pipelines)
-dbbackup drill report --format json --output drill-results.json
-
-# Markdown report (GitHub integration)
-dbbackup drill report --format markdown --output drill-results.md
-```
-
-### Example Report Format
-
-```
-Disaster Recovery Drill Results
-================================
-
-Backup: myapp_2026-01-23_14-30-00.dump.gz
-Date: 2026-01-25 03:15:00
-Duration: 5m 32s
-Status: PASSED
-
-Details:
-  Extract Time:        1m 15s
-  Restore Time:        3m 42s
-  Validation Time:     34s
-  
-  Tables Restored:     42
-  Rows Verified:       1,234,567
-  Total Size:          2.5 GB
-  
-Validation:
-  Schema Check:        OK
-  Row Count Check:     OK (all tables)
-  Index Check:         OK (all 28 indexes present)
-  Constraint Check:    OK (all 5 foreign keys valid)
-  
-Warnings: None
-Errors: None
-```
-
-## Integration with CI/CD
-
-### GitHub Actions
-
-```yaml
-name: Daily DR Drill
-
-on:
-  schedule:
-    - cron: '0 3 * * *'  # Daily at 03:00
-
-jobs:
-  dr-drill:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Run DR drill
-        run: |
-          dbbackup drill /backups/databases \
-            --full-validation \
-            --format json \
-            --output results.json
-      
-      - name: Check results
-        run: |
-          if grep -q '"status":"failed"' results.json; then
-            echo "DR drill failed!"
-            exit 1
-          fi
-      
-      - name: Upload report
-        uses: actions/upload-artifact@v2
-        with:
-          name: drill-results
-          path: results.json
-```
-
-### Jenkins Pipeline
-
-```groovy
-pipeline {
-  triggers {
-    cron('H 3 * * *')  // Daily at 03:00
-  }
-  
-  stages {
-    stage('DR Drill') {
-      steps {
-        sh 'dbbackup drill /backups/databases --full-validation --format json --output drill.json'
-      }
-    }
-    
-    stage('Validate Results') {
-      steps {
-        script {
-          def results = readJSON file: 'drill.json'
-          if (results.status != 'passed') {
-            error("DR drill failed!")
-          }
-        }
-      }
-    }
-  }
-}
-```
-
-## Troubleshooting
-
-### Drill Fails with "Out of Space"
-
-```bash
-# Check available disk space
-df -h
-
-# Clean up old test databases
-docker system prune -a
-
-# Use faster storage for test
-dbbackup drill /mnt/backups/databases --temp-dir /ssd/drill-temp
-```
-
-### Drill Times Out
-
-```bash
-# Increase timeout (minutes)
-dbbackup drill /mnt/backups/databases --timeout 30
-
-# Skip certain validations to speed up
-dbbackup drill /mnt/backups/databases --quick-validation
-```
-
-### Drill Shows Data Mismatch
-
-Indicates a problem with the backup - investigate immediately:
-
-```bash
-# Get detailed diff report
-dbbackup drill report --show-diffs myapp_2026-01-23.dump.gz
-
-# Regenerate backup
-dbbackup backup single myapp --force-full
-```
-
-## Best Practices
-
-1. **Run weekly drills minimum** - Catch issues early
-
-2. **Test oldest backups** - Verify full retention chain works
-   ```bash
-   dbbackup drill /mnt/backups/databases --oldest
-   ```
-
-3. **Test critical databases first** - Prioritize by impact
-
-4. **Store results in catalog** - Track historical pass/fail rates
-
-5. **Alert on failures** - Automatic notification via email/Slack
-
-6. **Document RTO** - Use drill times to refine recovery objectives
-
-7. **Test cross-major-versions** - Use test environment with different DB version
-   ```bash
-   # Test PostgreSQL 15 backup on PostgreSQL 16
-   dbbackup drill /mnt/backups/databases --target-version 16
-   ```

docs/EXPORTER.md

@@ -1,537 +0,0 @@
-# DBBackup Prometheus Exporter & Grafana Dashboard
-
-This document provides complete reference for the DBBackup Prometheus exporter, including all exported metrics, setup instructions, and Grafana dashboard configuration.
-
-## What's New (January 2026)
-
-### New Features
-- **Backup Type Tracking**: All backup metrics now include a `backup_type` label (`full`, `incremental`, or `pitr_base` for PITR base backups)
-  - **Note**: CLI `--backup-type` flag only accepts `full` or `incremental`. The `pitr_base` label is auto-assigned when using `dbbackup pitr base`
-- **PITR Metrics**: Complete Point-in-Time Recovery monitoring for PostgreSQL WAL and MySQL binlog archiving
-- **New Alerts**: PITR-specific alerts for archive lag, chain integrity, and gap detection
-
-### New Metrics Added
-| Metric | Description |
-|--------|-------------|
-| `dbbackup_build_info` | Build info with version and commit labels |
-| `dbbackup_backup_by_type` | Count backups by type (full/incremental/pitr_base) |
-| `dbbackup_pitr_enabled` | Whether PITR is enabled (1/0) |
-| `dbbackup_pitr_archive_lag_seconds` | Seconds since last WAL/binlog archived |
-| `dbbackup_pitr_chain_valid` | WAL/binlog chain integrity (1=valid) |
-| `dbbackup_pitr_gap_count` | Number of gaps in archive chain |
-| `dbbackup_pitr_archive_count` | Total archived segments |
-| `dbbackup_pitr_archive_size_bytes` | Total archive storage |
-| `dbbackup_pitr_recovery_window_minutes` | Estimated PITR coverage |
-
-### Label Changes
-- `backup_type` label added to: `dbbackup_rpo_seconds`, `dbbackup_last_success_timestamp`, `dbbackup_last_backup_duration_seconds`, `dbbackup_last_backup_size_bytes`
-- `dbbackup_backup_total` type changed from counter to gauge (more accurate for snapshot-based collection)
-
----
-
-## Table of Contents
-
-- [Quick Start](#quick-start)
-- [Exporter Modes](#exporter-modes)
-- [Complete Metrics Reference](#complete-metrics-reference)
-- [Grafana Dashboard Setup](#grafana-dashboard-setup)
-- [Alerting Rules](#alerting-rules)
-- [Troubleshooting](#troubleshooting)
-
----
-
-## Quick Start
-
-### Start the Metrics Server
-
-```bash
-# Start HTTP exporter on default port 9399 (auto-detects hostname for server label)
-dbbackup metrics serve
-
-# Custom port
-dbbackup metrics serve --port 9100
-
-# Specify server name for labels (overrides auto-detection)
-dbbackup metrics serve --server production-db-01
-
-# Specify custom catalog database location
-dbbackup metrics serve --catalog-db /path/to/catalog.db
-```
-
-### Export to Textfile (for node_exporter)
-
-```bash
-# Export to default location
-dbbackup metrics export
-
-# Custom output path
-dbbackup metrics export --output /var/lib/node_exporter/textfile_collector/dbbackup.prom
-
-# Specify catalog database and server name
-dbbackup metrics export --catalog-db /root/.dbbackup/catalog.db --server myhost
-```
-
-### Install as Systemd Service
-
-```bash
-# Install with metrics exporter
-sudo dbbackup install --with-metrics
-
-# Start the service
-sudo systemctl start dbbackup-exporter
-```
-
----
-
-## Exporter Modes
-
-### HTTP Server Mode (`metrics serve`)
-
-Runs a standalone HTTP server exposing metrics for direct Prometheus scraping.
-
-| Endpoint    | Description                      |
-|-------------|----------------------------------|
-| `/metrics`  | Prometheus metrics               |
-| `/health`   | Health check (returns 200 OK)    |
-| `/`         | Service info page                |
-
-**Default Port:** 9399
-
-**Server Label:** Auto-detected from hostname (use `--server` to override)
-
-**Catalog Location:** `~/.dbbackup/catalog.db` (use `--catalog-db` to override)
-
-**Configuration:**
-```bash
-dbbackup metrics serve [--server <instance-name>] [--port <port>] [--catalog-db <path>]
-```
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--server` | hostname | Server label for metrics (auto-detected if not set) |
-| `--port` | 9399 | HTTP server port |
-| `--catalog-db` | ~/.dbbackup/catalog.db | Path to catalog SQLite database |
-
-### Textfile Mode (`metrics export`)
-
-Writes metrics to a file for collection by node_exporter's textfile collector.
-
-**Default Path:** `/var/lib/dbbackup/metrics/dbbackup.prom`
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--server` | hostname | Server label for metrics (auto-detected if not set) |
-| `--output` | /var/lib/dbbackup/metrics/dbbackup.prom | Output file path |
-| `--catalog-db` | ~/.dbbackup/catalog.db | Path to catalog SQLite database |
-
-**node_exporter Configuration:**
-```bash
-node_exporter --collector.textfile.directory=/var/lib/dbbackup/metrics/
-```
-
----
-
-## Complete Metrics Reference
-
-All metrics use the `dbbackup_` prefix. Below is the **validated** list of metrics exported by DBBackup.
-
-### Backup Status Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_last_success_timestamp` | gauge | `server`, `database`, `engine`, `backup_type` | Unix timestamp of last successful backup |
-| `dbbackup_last_backup_duration_seconds` | gauge | `server`, `database`, `engine`, `backup_type` | Duration of last successful backup in seconds |
-| `dbbackup_last_backup_size_bytes` | gauge | `server`, `database`, `engine`, `backup_type` | Size of last successful backup in bytes |
-| `dbbackup_backup_total` | gauge | `server`, `database`, `status` | Total backup attempts (status: `success` or `failure`) |
-| `dbbackup_backup_by_type` | gauge | `server`, `database`, `backup_type` | Backup count by type (`full`, `incremental`, `pitr_base`) |
-| `dbbackup_rpo_seconds` | gauge | `server`, `database`, `backup_type` | Seconds since last successful backup (RPO) |
-| `dbbackup_backup_verified` | gauge | `server`, `database` | Whether last backup was verified (1=yes, 0=no) |
-| `dbbackup_scrape_timestamp` | gauge | `server` | Unix timestamp when metrics were collected |
-
-### PITR (Point-in-Time Recovery) Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_pitr_enabled` | gauge | `server`, `database`, `engine` | Whether PITR is enabled (1=yes, 0=no) |
-| `dbbackup_pitr_last_archived_timestamp` | gauge | `server`, `database`, `engine` | Unix timestamp of last archived WAL/binlog |
-| `dbbackup_pitr_archive_lag_seconds` | gauge | `server`, `database`, `engine` | Seconds since last archive (lower is better) |
-| `dbbackup_pitr_archive_count` | gauge | `server`, `database`, `engine` | Total archived WAL segments or binlog files |
-| `dbbackup_pitr_archive_size_bytes` | gauge | `server`, `database`, `engine` | Total size of archived logs in bytes |
-| `dbbackup_pitr_chain_valid` | gauge | `server`, `database`, `engine` | Whether archive chain is valid (1=yes, 0=gaps) |
-| `dbbackup_pitr_gap_count` | gauge | `server`, `database`, `engine` | Number of gaps in archive chain |
-| `dbbackup_pitr_recovery_window_minutes` | gauge | `server`, `database`, `engine` | Estimated PITR coverage window in minutes |
-| `dbbackup_pitr_scrape_timestamp` | gauge | `server` | PITR metrics collection timestamp |
-
-### Deduplication Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_dedup_chunks_total` | gauge | `server` | Total unique chunks stored |
-| `dbbackup_dedup_manifests_total` | gauge | `server` | Total number of deduplicated backups |
-| `dbbackup_dedup_backup_bytes_total` | gauge | `server` | Total logical size of all backups (bytes) |
-| `dbbackup_dedup_stored_bytes_total` | gauge | `server` | Total unique data stored after dedup (bytes) |
-| `dbbackup_dedup_space_saved_bytes` | gauge | `server` | Bytes saved by deduplication |
-| `dbbackup_dedup_ratio` | gauge | `server` | Dedup efficiency (0-1, higher = better) |
-| `dbbackup_dedup_disk_usage_bytes` | gauge | `server` | Actual disk usage of chunk store |
-| `dbbackup_dedup_compression_ratio` | gauge | `server` | Compression ratio (0-1, higher = better) |
-| `dbbackup_dedup_oldest_chunk_timestamp` | gauge | `server` | Unix timestamp of oldest chunk |
-| `dbbackup_dedup_newest_chunk_timestamp` | gauge | `server` | Unix timestamp of newest chunk |
-| `dbbackup_dedup_scrape_timestamp` | gauge | `server` | Dedup metrics collection timestamp |
-
-### Per-Database Dedup Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_dedup_database_backup_count` | gauge | `server`, `database` | Deduplicated backups per database |
-| `dbbackup_dedup_database_ratio` | gauge | `server`, `database` | Per-database dedup ratio |
-| `dbbackup_dedup_database_last_backup_timestamp` | gauge | `server`, `database` | Last backup timestamp per database |
-| `dbbackup_dedup_database_total_bytes` | gauge | `server`, `database` | Total logical size per database |
-| `dbbackup_dedup_database_stored_bytes` | gauge | `server`, `database` | Stored bytes per database (after dedup) |
-| `dbbackup_rpo_seconds` | gauge | `server`, `database` | Seconds since last backup (same as regular backups for unified alerting) |
-
-> **Note:** The `dbbackup_rpo_seconds` metric is exported by both regular backups and dedup backups, enabling unified alerting without complex PromQL expressions.
-
----
-
-## Example Metrics Output
-
-```prometheus
-# DBBackup Prometheus Metrics
-# Generated at: 2026-01-27T10:30:00Z
-# Server: production
-
-# HELP dbbackup_last_success_timestamp Unix timestamp of last successful backup
-# TYPE dbbackup_last_success_timestamp gauge
-dbbackup_last_success_timestamp{server="production",database="myapp",engine="postgres",backup_type="full"} 1737884600
-
-# HELP dbbackup_last_backup_duration_seconds Duration of last successful backup in seconds
-# TYPE dbbackup_last_backup_duration_seconds gauge
-dbbackup_last_backup_duration_seconds{server="production",database="myapp",engine="postgres",backup_type="full"} 125.50
-
-# HELP dbbackup_last_backup_size_bytes Size of last successful backup in bytes
-# TYPE dbbackup_last_backup_size_bytes gauge
-dbbackup_last_backup_size_bytes{server="production",database="myapp",engine="postgres",backup_type="full"} 1073741824
-
-# HELP dbbackup_backup_total Total number of backup attempts by type and status
-# TYPE dbbackup_backup_total gauge
-dbbackup_backup_total{server="production",database="myapp",status="success"} 42
-dbbackup_backup_total{server="production",database="myapp",status="failure"} 2
-
-# HELP dbbackup_backup_by_type Total number of backups by backup type
-# TYPE dbbackup_backup_by_type gauge
-dbbackup_backup_by_type{server="production",database="myapp",backup_type="full"} 30
-dbbackup_backup_by_type{server="production",database="myapp",backup_type="incremental"} 12
-
-# HELP dbbackup_rpo_seconds Recovery Point Objective - seconds since last successful backup
-# TYPE dbbackup_rpo_seconds gauge
-dbbackup_rpo_seconds{server="production",database="myapp",backup_type="full"} 3600
-
-# HELP dbbackup_backup_verified Whether the last backup was verified (1=yes, 0=no)
-# TYPE dbbackup_backup_verified gauge
-dbbackup_backup_verified{server="production",database="myapp"} 1
-
-# HELP dbbackup_pitr_enabled Whether PITR is enabled for database (1=enabled, 0=disabled)
-# TYPE dbbackup_pitr_enabled gauge
-dbbackup_pitr_enabled{server="production",database="myapp",engine="postgres"} 1
-
-# HELP dbbackup_pitr_archive_lag_seconds Seconds since last WAL/binlog was archived
-# TYPE dbbackup_pitr_archive_lag_seconds gauge
-dbbackup_pitr_archive_lag_seconds{server="production",database="myapp",engine="postgres"} 45
-
-# HELP dbbackup_pitr_chain_valid Whether the WAL/binlog chain is valid (1=valid, 0=gaps detected)
-# TYPE dbbackup_pitr_chain_valid gauge
-dbbackup_pitr_chain_valid{server="production",database="myapp",engine="postgres"} 1
-
-# HELP dbbackup_pitr_recovery_window_minutes Estimated recovery window in minutes
-# TYPE dbbackup_pitr_recovery_window_minutes gauge
-dbbackup_pitr_recovery_window_minutes{server="production",database="myapp",engine="postgres"} 10080
-
-# HELP dbbackup_dedup_ratio Deduplication ratio (0-1, higher is better)
-# TYPE dbbackup_dedup_ratio gauge
-dbbackup_dedup_ratio{server="production"} 0.6500
-
-# HELP dbbackup_dedup_space_saved_bytes Bytes saved by deduplication
-# TYPE dbbackup_dedup_space_saved_bytes gauge
-dbbackup_dedup_space_saved_bytes{server="production"} 5368709120
-```
-
----
-
-## Prometheus Scrape Configuration
-
-Add to your `prometheus.yml`:
-
-```yaml
-scrape_configs:
-  - job_name: 'dbbackup'
-    scrape_interval: 60s
-    scrape_timeout: 10s
-    
-    static_configs:
-      - targets:
-          - 'db-server-01:9399'
-          - 'db-server-02:9399'
-        labels:
-          environment: 'production'
-      
-      - targets:
-          - 'db-staging:9399'
-        labels:
-          environment: 'staging'
-    
-    relabel_configs:
-      - source_labels: [__address__]
-        target_label: instance
-        regex: '([^:]+):\d+'
-        replacement: '$1'
-```
-
-### File-based Service Discovery
-
-```yaml
-  - job_name: 'dbbackup-sd'
-    scrape_interval: 60s
-    file_sd_configs:
-      - files:
-          - '/etc/prometheus/targets/dbbackup/*.yml'
-        refresh_interval: 5m
-```
-
----
-
-## Grafana Dashboard Setup
-
-### Import Dashboard
-
-1. Open Grafana → **Dashboards** → **Import**
-2. Upload `grafana/dbbackup-dashboard.json` or paste the JSON
-3. Select your Prometheus data source
-4. Click **Import**
-
-### Dashboard Panels
-
-The dashboard includes the following panels:
-
-#### Backup Overview Row
-| Panel | Metric Used | Description |
-|-------|-------------|-------------|
-| Last Backup Status | `dbbackup_rpo_seconds < bool 604800` | SUCCESS/FAILED indicator |
-| Time Since Last Backup | `dbbackup_rpo_seconds` | Time elapsed since last backup |
-| Verification Status | `dbbackup_backup_verified` | VERIFIED/NOT VERIFIED |
-| Total Successful Backups | `dbbackup_backup_total{status="success"}` | Counter |
-| Total Failed Backups | `dbbackup_backup_total{status="failure"}` | Counter |
-| RPO Over Time | `dbbackup_rpo_seconds` | Time series graph |
-| Backup Size | `dbbackup_last_backup_size_bytes` | Bar chart |
-| Backup Duration | `dbbackup_last_backup_duration_seconds` | Time series |
-| Backup Status Overview | Multiple metrics | Table with color-coded status |
-
-#### Deduplication Statistics Row
-| Panel | Metric Used | Description |
-|-------|-------------|-------------|
-| Dedup Ratio | `dbbackup_dedup_ratio` | Percentage efficiency |
-| Space Saved | `dbbackup_dedup_space_saved_bytes` | Total bytes saved |
-| Disk Usage | `dbbackup_dedup_disk_usage_bytes` | Actual storage used |
-| Total Chunks | `dbbackup_dedup_chunks_total` | Chunk count |
-| Compression Ratio | `dbbackup_dedup_compression_ratio` | Compression efficiency |
-| Oldest Chunk | `dbbackup_dedup_oldest_chunk_timestamp` | Age of oldest data |
-| Newest Chunk | `dbbackup_dedup_newest_chunk_timestamp` | Most recent chunk |
-| Dedup Ratio by Database | `dbbackup_dedup_database_ratio` | Per-database efficiency |
-| Dedup Storage Over Time | `dbbackup_dedup_space_saved_bytes`, `dbbackup_dedup_disk_usage_bytes` | Storage trends |
-
-### Dashboard Variables
-
-| Variable | Query | Description |
-|----------|-------|-------------|
-| `$server` | `label_values(dbbackup_rpo_seconds, server)` | Filter by server |
-| `$DS_PROMETHEUS` | datasource | Prometheus data source |
-
-### Dashboard Thresholds
-
-#### RPO Thresholds
-- **Green:** < 12 hours (43200 seconds)
-- **Yellow:** 12-24 hours
-- **Red:** > 24 hours (86400 seconds)
-
-#### Backup Status Thresholds
-- **1 (Green):** SUCCESS
-- **0 (Red):** FAILED
-
----
-
-## Alerting Rules
-
-### Pre-configured Alerts
-
-Import `deploy/prometheus/alerting-rules.yaml` into Prometheus/Alertmanager.
-
-#### Backup Status Alerts
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupRPOWarning` | `dbbackup_rpo_seconds > 43200` | warning | No backup for 12+ hours |
-| `DBBackupRPOCritical` | `dbbackup_rpo_seconds > 86400` | critical | No backup for 24+ hours |
-| `DBBackupFailed` | `increase(dbbackup_backup_total{status="failure"}[1h]) > 0` | critical | Backup failed |
-| `DBBackupFailureRateHigh` | Failure rate > 10% in 24h | warning | High failure rate |
-| `DBBackupSizeAnomaly` | Size changed > 50% vs 7-day avg | warning | Unusual backup size |
-| `DBBackupSizeZero` | `dbbackup_last_backup_size_bytes == 0` | critical | Empty backup file |
-| `DBBackupDurationHigh` | `dbbackup_last_backup_duration_seconds > 3600` | warning | Backup taking > 1 hour |
-| `DBBackupNotVerified` | `dbbackup_backup_verified == 0` for 24h | warning | Backup not verified |
-| `DBBackupNoRecentFull` | No full backup in 7+ days | warning | Need full backup for incremental chain |
-
-#### PITR Alerts (New)
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupPITRArchiveLag` | `dbbackup_pitr_archive_lag_seconds > 600` | warning | Archive 10+ min behind |
-| `DBBackupPITRArchiveCritical` | `dbbackup_pitr_archive_lag_seconds > 1800` | critical | Archive 30+ min behind |
-| `DBBackupPITRChainBroken` | `dbbackup_pitr_chain_valid == 0` | critical | Gaps in WAL/binlog chain |
-| `DBBackupPITRGaps` | `dbbackup_pitr_gap_count > 0` | warning | Gaps detected in archive chain |
-| `DBBackupPITRDisabled` | PITR unexpectedly disabled | critical | PITR was enabled but now off |
-
-#### Infrastructure Alerts
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupExporterDown` | `up{job="dbbackup"} == 0` | critical | Exporter unreachable |
-| `DBBackupDedupRatioLow` | `dbbackup_dedup_ratio < 0.2` for 24h | info | Low dedup efficiency |
-| `DBBackupStorageHigh` | `dbbackup_dedup_disk_usage_bytes > 1TB` | warning | High storage usage |
-
-### Example Alert Configuration
-
-```yaml
-groups:
-  - name: dbbackup
-    rules:
-      - alert: DBBackupRPOCritical
-        expr: dbbackup_rpo_seconds > 86400
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "No backup for {{ $labels.database }} in 24+ hours"
-          description: "RPO violation on {{ $labels.server }}. Last backup: {{ $value | humanizeDuration }} ago."
-      
-      - alert: DBBackupPITRChainBroken
-        expr: dbbackup_pitr_chain_valid == 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR chain broken for {{ $labels.database }}"
-          description: "WAL/binlog chain has gaps. Point-in-time recovery is NOT possible. New base backup required."
-```
-
----
-
-## Troubleshooting
-
-### Exporter Not Returning Metrics
-
-1. **Check catalog access:**
-   ```bash
-   dbbackup catalog list
-   ```
-
-2. **Verify port is open:**
-   ```bash
-   curl -v http://localhost:9399/metrics
-   ```
-
-3. **Check logs:**
-   ```bash
-   journalctl -u dbbackup-exporter -f
-   ```
-
-### Missing Dedup Metrics
-
-Dedup metrics are only exported when using deduplication:
-```bash
-# Ensure dedup is enabled
-dbbackup dedup status
-```
-
-### Metrics Not Updating
-
-The exporter caches metrics for 30 seconds. The `/health` endpoint can confirm the exporter is running.
-
-### Stale or Empty Metrics (Catalog Location Mismatch)
-
-If the exporter shows stale or no backup data, verify the catalog database location:
-
-```bash
-# Check where catalog sync writes
-dbbackup catalog sync /path/to/backups
-# Output shows: [STATS] Catalog database: /root/.dbbackup/catalog.db
-
-# Ensure exporter reads from the same location
-dbbackup metrics serve --catalog-db /root/.dbbackup/catalog.db
-```
-
-**Common Issue:** If backup scripts run as root but the exporter runs as a different user, they may use different catalog locations. Use `--catalog-db` to ensure consistency.
-
-### Dashboard Shows "No Data"
-
-1. Verify Prometheus is scraping successfully:
-   ```bash
-   curl http://prometheus:9090/api/v1/targets | grep dbbackup
-   ```
-
-2. Check metric names match (case-sensitive):
-   ```promql
-   {__name__=~"dbbackup_.*"}
-   ```
-
-3. Verify `server` label matches dashboard variable.
-
-### Label Mismatch Issues
-
-Ensure the `--server` flag matches across all instances:
-```bash
-# Consistent naming (or let it auto-detect from hostname)
-dbbackup metrics serve --server prod-db-01
-```
-
-> **Note:** As of v3.x, the exporter auto-detects hostname if `--server` is not specified. This ensures unique server labels in multi-host deployments.
-
----
-
-## Metrics Validation Checklist
-
-Use this checklist to validate your exporter setup:
-
-- [ ] `/metrics` endpoint returns HTTP 200
-- [ ] `/health` endpoint returns `{"status":"ok"}`
-- [ ] `dbbackup_rpo_seconds` shows correct RPO values
-- [ ] `dbbackup_backup_total` increments after backups
-- [ ] `dbbackup_backup_verified` reflects verification status
-- [ ] `dbbackup_last_backup_size_bytes` matches actual backup sizes
-- [ ] Prometheus scrape succeeds (check targets page)
-- [ ] Grafana dashboard loads without errors
-- [ ] Dashboard variables populate correctly
-- [ ] All panels show data (no "No Data" messages)
-
----
-
-## Files Reference
-
-| File | Description |
-|------|-------------|
-| `grafana/dbbackup-dashboard.json` | Grafana dashboard JSON |
-| `grafana/alerting-rules.yaml` | Grafana alerting rules |
-| `deploy/prometheus/alerting-rules.yaml` | Prometheus alerting rules |
-| `deploy/prometheus/scrape-config.yaml` | Prometheus scrape configuration |
-| `docs/METRICS.md` | Metrics documentation |
-
----
-
-## Version Compatibility
-
-| DBBackup Version | Metrics Version | Dashboard UID |
-|------------------|-----------------|---------------|
-| 1.0.0+           | v1              | `dbbackup-overview` |
-
----
-
-## Support
-
-For issues with the exporter or dashboard:
-1. Check the [troubleshooting section](#troubleshooting)
-2. Review logs: `journalctl -u dbbackup-exporter`
-3. Open an issue with metrics output and dashboard screenshots

docs/LOCK_DEBUGGING.md

@@ -1,266 +0,0 @@
-# Lock Debugging Feature
-
-## Overview
-
-The `--debug-locks` flag provides complete visibility into the lock protection system introduced in v3.42.82. This eliminates the need for blind troubleshooting when diagnosing lock exhaustion issues.
-
-## Problem
-
-When PostgreSQL lock exhaustion occurs during restore:
-- User sees "out of shared memory" error after 7 hours
-- No visibility into why Large DB Guard chose conservative mode  
-- Unknown whether lock boost attempts succeeded
-- Unclear what actions are required to fix the issue
-- Requires 14 days of troubleshooting to understand the problem
-
-## Solution
-
-New `--debug-locks` flag captures every decision point in the lock protection system with detailed logging prefixed by [LOCK-DEBUG].
-
-## Usage
-
-### CLI
-```bash
-# Single database restore with lock debugging
-dbbackup restore single mydb.dump --debug-locks --confirm
-
-# Cluster restore with lock debugging  
-dbbackup restore cluster backup.tar.gz --debug-locks --confirm
-
-# Can also use global flag
-dbbackup --debug-locks restore cluster backup.tar.gz --confirm
-```
-
-### TUI (Interactive Mode)
-```bash
-dbbackup  # Start interactive mode
-# Navigate to restore operation
-# Select your archive
-# Press 'l' to toggle lock debugging (LOCK-DEBUG icon appears when enabled)
-# Press Enter to proceed
-```
-
-## What Gets Logged
-
-### 1. Strategy Analysis Entry Point
-```
-[LOCK-DEBUG] Large DB Guard: Starting strategy analysis
-    archive=cluster_backup.tar.gz
-    dump_count=15
-```
-
-### 2. PostgreSQL Configuration Detection
-```
-[LOCK-DEBUG] Querying PostgreSQL for lock configuration
-    host=localhost
-    port=5432
-    user=postgres
-
-[LOCK-DEBUG] Successfully retrieved PostgreSQL lock settings
-    max_locks_per_transaction=2048
-    max_connections=256
-    total_capacity=524288
-```
-
-### 3. Guard Decision Logic  
-```
-[LOCK-DEBUG] PostgreSQL lock configuration detected
-    max_locks_per_transaction=2048
-    max_connections=256
-    calculated_capacity=524288
-    threshold_required=4096
-    below_threshold=true
-
-[LOCK-DEBUG] Guard decision: CONSERVATIVE mode
-    jobs=1
-    parallel_dbs=1
-    reason="Lock threshold not met (max_locks < 4096)"
-```
-
-### 4. Lock Boost Attempts
-```
-[LOCK-DEBUG] boostPostgreSQLSettings: Starting lock boost procedure
-    target_lock_value=4096
-
-[LOCK-DEBUG] Current PostgreSQL lock configuration
-    current_max_locks=2048
-    target_max_locks=4096
-    boost_required=true
-
-[LOCK-DEBUG] Executing ALTER SYSTEM to boost locks
-    from=2048
-    to=4096
-
-[LOCK-DEBUG] ALTER SYSTEM succeeded - restart required
-    setting_saved_to=postgresql.auto.conf
-    active_after="PostgreSQL restart"
-```
-
-### 5. PostgreSQL Restart Attempts
-```
-[LOCK-DEBUG] Attempting PostgreSQL restart to activate new lock setting
-
-# If restart succeeds:
-[LOCK-DEBUG] PostgreSQL restart SUCCEEDED
-
-[LOCK-DEBUG] Post-restart verification
-    new_max_locks=4096
-    target_was=4096
-    verification=PASS
-
-# If restart fails:
-[LOCK-DEBUG] PostgreSQL restart FAILED
-    current_locks=2048
-    required_locks=4096
-    setting_saved=true
-    setting_active=false
-    verdict="ABORT - Manual restart required"
-```
-
-### 6. Final Verification
-```
-[LOCK-DEBUG] Lock boost function returned
-    original_max_locks=2048
-    target_max_locks=4096
-    boost_successful=false
-
-[LOCK-DEBUG] CRITICAL: Lock verification FAILED
-    actual_locks=2048
-    required_locks=4096
-    delta=2048
-    verdict="ABORT RESTORE"
-```
-
-## Example Workflow
-
-### Scenario: Lock Exhaustion on New System
-
-```bash
-# Step 1: Run restore with lock debugging enabled
-dbbackup restore cluster backup.tar.gz --debug-locks --confirm
-
-# Output shows:
-# [LOCK-DEBUG] Guard decision: CONSERVATIVE mode
-#     current_locks=2048, required=4096
-#     verdict="ABORT - Manual restart required"
-
-# Step 2: Follow the actionable instructions
-sudo -u postgres psql -c "ALTER SYSTEM SET max_locks_per_transaction = 4096;"
-sudo systemctl restart postgresql
-
-# Step 3: Verify the change
-sudo -u postgres psql -c "SHOW max_locks_per_transaction;"
-# Output: 4096
-
-# Step 4: Retry restore (can disable debug now)
-dbbackup restore cluster backup.tar.gz --confirm
-
-# Success! Restore proceeds with verified lock protection
-```
-
-## When to Use
-
-### Enable Lock Debugging When:
-- Diagnosing lock exhaustion failures
-- Understanding why conservative mode was triggered
-- Verifying lock boost attempts worked
-- Troubleshooting "out of shared memory" errors  
-- Setting up restore on new systems with unknown lock config
-- Documenting lock requirements for compliance/security
-
-### Leave Disabled For:
-- Normal production restores (cleaner logs)
-- Scripted/automated restores (less noise)
-- When lock config is known to be sufficient
-- When restore performance is critical
-
-## Integration Points
-
-### Configuration
-- **Config Field:** `cfg.DebugLocks` (bool)
-- **CLI Flag:** `--debug-locks` (persistent flag on root command)
-- **TUI Toggle:** Press 'l' in restore preview screen
-- **Default:** `false` (opt-in only)
-
-### Files Modified
-- `internal/config/config.go` - Added DebugLocks field
-- `cmd/root.go` - Added --debug-locks persistent flag
-- `cmd/restore.go` - Wired flag to single/cluster restore commands
-- `internal/restore/large_db_guard.go` - 20+ debug log points
-- `internal/restore/engine.go` - 15+ debug log points in boost logic
-- `internal/tui/restore_preview.go` - 'l' key toggle with LOCK-DEBUG icon
-
-### Log Locations
-All lock debug logs go to the configured logger (usually syslog or file) with level INFO. The [LOCK-DEBUG] prefix makes them easy to grep:
-
-```bash
-# Filter lock debug logs
-journalctl -u dbbackup | grep 'LOCK-DEBUG'
-
-# Or in log files
-grep 'LOCK-DEBUG' /var/log/dbbackup.log
-```
-
-## Backward Compatibility
-
-- No breaking changes
-- ✅ Flag defaults to false (no output unless enabled)
-- ✅ Existing scripts continue to work unchanged
-- ✅ TUI users get new 'l' toggle automatically
-- ✅ CLI users can add --debug-locks when needed
-
-## Performance Impact
-
-Negligible - the debug logging only adds:
-- ~5 database queries (SHOW commands)
-- ~10 conditional if statements checking cfg.DebugLocks
-- ~50KB of additional log output when enabled
-- No impact on restore performance itself
-
-## Relationship to v3.42.82
-
-This feature completes the lock protection system:
-
-**v3.42.82 (Protection):**
-- Fixed Guard to always force conservative mode if max_locks < 4096
-- Fixed engine to abort restore if lock boost fails  
-- Ensures no path allows 7-hour failures
-
-**v3.42.83 (Visibility):**
-- Shows why Guard chose conservative mode
-- Displays lock config that was detected
-- Tracks boost attempts and outcomes
-- Explains why restore was aborted
-
-Together: Bulletproof protection + complete transparency.
-
-## Deployment
-
-1. Update to v3.42.83:
-   ```bash
-   wget https://github.com/PlusOne/dbbackup/releases/download/v3.42.83/dbbackup_linux_amd64
-   chmod +x dbbackup_linux_amd64
-   sudo mv dbbackup_linux_amd64 /usr/local/bin/dbbackup
-   ```
-
-2. Test lock debugging:
-   ```bash
-   dbbackup restore cluster test_backup.tar.gz --debug-locks --dry-run
-   ```
-
-3. Enable for production if diagnosing issues:
-   ```bash
-   dbbackup restore cluster production_backup.tar.gz --debug-locks --confirm
-   ```
-
-## Support
-
-For issues related to lock debugging:
-- Check logs for [LOCK-DEBUG] entries
-- Verify PostgreSQL version supports ALTER SYSTEM (9.4+)
-- Ensure user has SUPERUSER role for ALTER SYSTEM
-- Check systemd/init scripts can restart PostgreSQL
-
-Related documentation:
-- verify_postgres_locks.sh - Script to check lock configuration
-- v3.42.82 release notes - Lock exhaustion bug fixes

docs/METRICS.md

@@ -1,314 +0,0 @@
-# DBBackup Prometheus Metrics
-
-This document describes all Prometheus metrics exposed by DBBackup for monitoring and alerting.
-
-## Backup Status Metrics
-
-### `dbbackup_rpo_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `backup_type`  
-**Description:** Time in seconds since the last successful backup (Recovery Point Objective).
-
-**Recommended Thresholds:**
-- Green: < 43200 (12 hours)
-- Yellow: 43200-86400 (12-24 hours)  
-- Red: > 86400 (24+ hours)
-
-**Example Query:**
-```promql
-dbbackup_rpo_seconds{server="prod-db-01"} > 86400
-
-# RPO by backup type
-dbbackup_rpo_seconds{backup_type="full"}
-dbbackup_rpo_seconds{backup_type="incremental"}
-```
-
----
-
-### `dbbackup_backup_total`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `status`  
-**Description:** Total count of backup attempts, labeled by status (`success` or `failure`).
-
-**Example Query:**
-```promql
-# Total successful backups
-dbbackup_backup_total{status="success"}
-```
-
----
-
-### `dbbackup_backup_by_type`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `backup_type`  
-**Description:** Total count of backups by backup type (`full`, `incremental`, `pitr_base`).
-
-> **Note:** The `backup_type` label values are:
-> - `full` - Created with `--backup-type full` (default)
-> - `incremental` - Created with `--backup-type incremental`
-> - `pitr_base` - Auto-assigned when using `dbbackup pitr base` command
->
-> The CLI `--backup-type` flag only accepts `full` or `incremental`.
-
-**Example Query:**
-```promql
-# Count of each backup type
-dbbackup_backup_by_type{backup_type="full"}
-dbbackup_backup_by_type{backup_type="incremental"}
-dbbackup_backup_by_type{backup_type="pitr_base"}
-```
-
----
-
-### `dbbackup_backup_verified`
-**Type:** Gauge  
-**Labels:** `server`, `database`  
-**Description:** Whether the most recent backup was verified successfully (1 = verified, 0 = not verified).
-
----
-
-### `dbbackup_last_backup_size_bytes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Size of the last successful backup in bytes.
-
-**Example Query:**
-```promql
-# Total backup storage across all databases
-sum(dbbackup_last_backup_size_bytes)
-
-# Size by backup type
-dbbackup_last_backup_size_bytes{backup_type="full"}
-```
-
----
-
-### `dbbackup_last_backup_duration_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Duration of the last backup operation in seconds.
-
----
-
-### `dbbackup_last_success_timestamp`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Unix timestamp of the last successful backup.
-
----
-
-## PITR (Point-in-Time Recovery) Metrics
-
-### `dbbackup_pitr_enabled`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Whether PITR is enabled for the database (1 = enabled, 0 = disabled).
-
-**Example Query:**
-```promql
-# Check if PITR is enabled
-dbbackup_pitr_enabled{database="production"} == 1
-```
-
----
-
-### `dbbackup_pitr_last_archived_timestamp`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Unix timestamp of the last archived WAL segment (PostgreSQL) or binlog file (MySQL).
-
----
-
-### `dbbackup_pitr_archive_lag_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Seconds since the last WAL/binlog was archived. High values indicate archiving issues.
-
-**Recommended Thresholds:**
-- Green: < 300 (5 minutes)
-- Yellow: 300-600 (5-10 minutes)
-- Red: > 600 (10+ minutes)
-
-**Example Query:**
-```promql
-# Alert on high archive lag
-dbbackup_pitr_archive_lag_seconds > 600
-```
-
----
-
-### `dbbackup_pitr_archive_count`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Total number of archived WAL segments or binlog files.
-
----
-
-### `dbbackup_pitr_archive_size_bytes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Total size of archived logs in bytes.
-
----
-
-### `dbbackup_pitr_chain_valid`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Whether the WAL/binlog chain is valid (1 = valid, 0 = gaps detected).
-
-**Example Query:**
-```promql
-# Alert on broken chain
-dbbackup_pitr_chain_valid == 0
-```
-
----
-
-### `dbbackup_pitr_gap_count`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Number of gaps detected in the WAL/binlog chain. Any value > 0 requires investigation.
-
----
-
-### `dbbackup_pitr_recovery_window_minutes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Estimated recovery window in minutes - the time span covered by archived logs.
-
----
-
-## Deduplication Metrics
-
-### `dbbackup_dedup_ratio`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Overall deduplication efficiency (0-1). A ratio of 0.5 means 50% space savings.
-
----
-
-### `dbbackup_dedup_database_ratio`
-**Type:** Gauge  
-**Labels:** `server`, `database`  
-**Description:** Per-database deduplication ratio.
-
----
-
-### `dbbackup_dedup_space_saved_bytes`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Total bytes saved by deduplication across all backups.
-
----
-
-### `dbbackup_dedup_disk_usage_bytes`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Actual disk usage of the chunk store after deduplication.
-
----
-
-### `dbbackup_dedup_chunks_total`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Total number of unique content-addressed chunks in the dedup store.
-
----
-
-### `dbbackup_dedup_compression_ratio`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Compression ratio achieved on chunk data (0-1). Higher = better compression.
-
----
-
-### `dbbackup_dedup_oldest_chunk_timestamp`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Unix timestamp of the oldest chunk. Useful for monitoring retention policy.
-
----
-
-### `dbbackup_dedup_newest_chunk_timestamp`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Unix timestamp of the newest chunk. Confirms dedup is working on recent backups.
-
----
-
-## Build Information Metrics
-
-### `dbbackup_build_info`
-**Type:** Gauge  
-**Labels:** `server`, `version`, `commit`, `build_time`  
-**Description:** Build information for the dbbackup exporter. Value is always 1.
-
-This metric is useful for:
-- Tracking which version is deployed across your fleet
-- Alerting when versions drift between servers
-- Correlating behavior changes with deployments
-
-**Example Queries:**
-```promql
-# Show all deployed versions
-group by (version) (dbbackup_build_info)
-
-# Find servers not on latest version
-dbbackup_build_info{version!="4.1.4"}
-
-# Alert on version drift
-count(count by (version) (dbbackup_build_info)) > 1
-
-# PITR archive lag
-dbbackup_pitr_archive_lag_seconds > 600
-
-# Check PITR chain integrity
-dbbackup_pitr_chain_valid == 1
-
-# Estimate available PITR window (in minutes)
-dbbackup_pitr_recovery_window_minutes
-
-# PITR gaps detected
-dbbackup_pitr_gap_count > 0
-```
-
----
-
-## Alerting Rules
-
-See [alerting-rules.yaml](../grafana/alerting-rules.yaml) for pre-configured Prometheus alerting rules.
-
-### Recommended Alerts
-
-| Alert Name | Condition | Severity |
-|------------|-----------|----------|
-| BackupStale | `dbbackup_rpo_seconds > 86400` | Critical |
-| BackupFailed | `increase(dbbackup_backup_total{status="failure"}[1h]) > 0` | Warning |
-| BackupNotVerified | `dbbackup_backup_verified == 0` | Warning |
-| DedupDegraded | `dbbackup_dedup_ratio < 0.1` | Info |
-| PITRArchiveLag | `dbbackup_pitr_archive_lag_seconds > 600` | Warning |
-| PITRChainBroken | `dbbackup_pitr_chain_valid == 0` | Critical |
-| PITRDisabled | `dbbackup_pitr_enabled == 0` (unexpected) | Critical |
-| NoIncrementalBackups | `dbbackup_backup_by_type{backup_type="incremental"} == 0` for 7d | Info |
-
----
-
-## Dashboard
-
-Import the [Grafana dashboard](../grafana/dbbackup-dashboard.json) for visualization of all metrics.
-
-## Exporting Metrics
-
-Metrics are exposed at `/metrics` when running with `--metrics` flag:
-
-```bash
-dbbackup backup cluster --metrics --metrics-port 9090
-```
-
-Or configure in `.dbbackup.conf`:
-```ini
-[metrics]
-enabled = true
-port = 9090
-path = /metrics
-```

docs/NATIVE_ENGINE_ROADMAP.md

@@ -1,213 +0,0 @@
-# Native Engine Implementation Roadmap
-## Complete Elimination of External Tool Dependencies
-
-### Current Status (Updated January 2026)
-- **External tools to eliminate**: pg_dump, pg_dumpall, pg_restore, psql, mysqldump, mysql, mysqlbinlog
-- **Target**: 100% pure Go implementation with zero external dependencies
-- **Benefit**: Self-contained binary, better integration, enhanced control
-- **Status**: Phase 1 and Phase 2 largely complete, Phase 3-5 in progress
-
-### Phase 1: Core Native Engines (8-12 weeks) - COMPLETE
-
-#### PostgreSQL Native Engine (4-6 weeks) - COMPLETE
-**Week 1-2: Foundation**
-- [x] Basic engine architecture and interfaces
-- [x] Connection management with pgx/v5
-- [x] SQL format backup implementation
-- [x] Basic table data export using COPY TO STDOUT
-- [x] Schema extraction from information_schema
-
-**Week 3-4: Advanced Features**
-- [x] Complete schema object support (tables, views, functions, sequences)
-- [x] Foreign key and constraint handling
-- [x] PostgreSQL data type support (arrays, JSON, custom types)
-- [x] Transaction consistency and locking
-- [x] Parallel table processing
-
-**Week 5-6: Formats and Polish**
-- [x] Custom format implementation (PostgreSQL binary format)
-- [x] Directory format support
-- [x] Tar format support
-- [x] Compression integration (pgzip, lz4, zstd)
-- [x] Progress reporting and metrics
-
-#### MySQL Native Engine (4-6 weeks) - COMPLETE
-**Week 1-2: Foundation**
-- [x] Basic engine architecture
-- [x] Connection management with go-sql-driver/mysql  
-- [x] SQL script generation
-- [x] Table data export with SELECT and INSERT statements
-- [x] Schema extraction from information_schema
-
-**Week 3-4: MySQL Specifics**
-- [x] Storage engine handling (InnoDB, MyISAM, etc.)
-- [x] MySQL data type support (including BLOB, TEXT variants)
-- [x] Character set and collation handling
-- [x] AUTO_INCREMENT and foreign key constraints
-- [x] Stored procedures, functions, triggers, events
-
-**Week 5-6: Enterprise Features**
-- [x] Binary log position capture (SHOW MASTER STATUS / SHOW BINARY LOG STATUS)
-- [x] GTID support for MySQL 5.6+
-- [x] Single transaction consistent snapshots
-- [x] Extended INSERT optimization
-- [x] MySQL-specific optimizations (DISABLE KEYS, etc.)
-
-### Phase 2: Advanced Protocol Features (6-8 weeks) - COMPLETE
-
-#### PostgreSQL Advanced (3-4 weeks) - COMPLETE
-- [x] **Custom format parser/writer**: Implement PostgreSQL's custom archive format
-- [x] **Large object (BLOB) support**: Handle pg_largeobject system catalog
-- [x] **Parallel processing**: Multiple worker goroutines for table dumping
-- [ ] **Incremental backup support**: Track LSN positions (partial)
-- [ ] **Point-in-time recovery**: WAL file integration (partial)
-
-#### MySQL Advanced (3-4 weeks) - COMPLETE
-- [x] **Binary log parsing**: Native implementation replacing mysqlbinlog
-- [x] **PITR support**: Binary log position tracking and replay
-- [x] **MyISAM vs InnoDB optimizations**: Engine-specific dump strategies
-- [x] **Parallel dumping**: Multi-threaded table processing
-- [ ] **Incremental support**: Binary log-based incremental backups (partial)
-
-### Phase 3: Restore Engines (4-6 weeks) - IN PROGRESS
-
-#### PostgreSQL Restore Engine
-- [x] **SQL script execution**: Native psql replacement
-- [ ] **Custom format restore**: Parse and restore from binary format
-- [x] **Selective restore**: Schema-only, data-only, table-specific
-- [ ] **Parallel restore**: Multi-worker restoration
-- [x] **Error handling**: Continue on error, skip existing objects
-
-#### MySQL Restore Engine  
-- [x] **SQL script execution**: Native mysql client replacement
-- [x] **Batch processing**: Efficient INSERT statement execution
-- [x] **Error recovery**: Handle duplicate key, constraint violations
-- [x] **Progress reporting**: Track restoration progress
-- [ ] **Point-in-time restore**: Apply binary logs to specific positions
-
-### Phase 4: Integration & Migration (2-4 weeks) - COMPLETE
-
-#### Engine Selection Framework
-- [x] **Configuration option**: `--native` flag enables native engines
-- [x] **Automatic fallback**: `--fallback-tools` uses tools if native engine fails
-- [x] **Performance comparison**: Benchmarking native vs tools
-- [x] **Feature parity validation**: Ensure native engines match tool behavior
-
-#### Code Integration
-- [x] **Update backup engine**: Integrate native engines into existing flow
-- [x] **Update restore engine**: Replace tool-based restore logic
-- [ ] **Update PITR**: Native binary log processing (partial)
-- [x] **Update verification**: Native dump file analysis
-
-#### Legacy Code Removal - DEFERRED
-- [ ] **Remove tool validation**: Keep ValidateBackupTools() for fallback mode
-- [ ] **Remove subprocess execution**: Keep exec.Command for fallback mode
-- [ ] **Remove tool-specific error handling**: Maintain for compatibility
-- [x] **Update documentation**: Native engine docs complete
-
-### Phase 5: Testing & Validation (4-6 weeks) - IN PROGRESS
-
-#### Comprehensive Test Suite
-- [x] **Unit tests**: All native engine components
-- [x] **Integration tests**: End-to-end backup/restore cycles  
-- [ ] **Performance tests**: Compare native vs tool-based approaches
-- [x] **Compatibility tests**: Various PostgreSQL/MySQL versions
-- [x] **Edge case tests**: Large databases, complex schemas, exotic data types
-
-#### Data Validation
-- [x] **Schema comparison**: Verify restored schema matches original
-- [x] **Data integrity**: Checksum validation of restored data  
-- [x] **Foreign key consistency**: Ensure referential integrity
-- [ ] **Performance benchmarks**: Backup/restore speed comparisons
-
-### Technical Implementation Details
-
-#### Key Components to Implement
-
-**PostgreSQL Protocol Details:**
-```go
-// Core SQL generation for schema objects
-func (e *PostgreSQLNativeEngine) generateTableDDL(ctx context.Context, schema, table string) (string, error)
-func (e *PostgreSQLNativeEngine) generateViewDDL(ctx context.Context, schema, view string) (string, error)
-func (e *PostgreSQLNativeEngine) generateFunctionDDL(ctx context.Context, schema, function string) (string, error)
-
-// Custom format implementation
-func (e *PostgreSQLNativeEngine) writeCustomFormatHeader(w io.Writer) error
-func (e *PostgreSQLNativeEngine) writeCustomFormatTOC(w io.Writer, objects []DatabaseObject) error
-func (e *PostgreSQLNativeEngine) writeCustomFormatData(w io.Writer, obj DatabaseObject) error
-```
-
-**MySQL Protocol Details:**
-```go
-// Binary log processing
-func (e *MySQLNativeEngine) parseBinlogEvent(data []byte) (*BinlogEvent, error)
-func (e *MySQLNativeEngine) applyBinlogEvent(ctx context.Context, event *BinlogEvent) error
-
-// Storage engine optimization
-func (e *MySQLNativeEngine) optimizeForEngine(engine string) *DumpStrategy
-func (e *MySQLNativeEngine) generateOptimizedInserts(rows [][]interface{}) []string
-```
-
-#### Performance Targets
-- **Backup Speed**: Match or exceed external tools (within 10%)
-- **Memory Usage**: Stay under 500MB for large database operations  
-- **Concurrency**: Support 4-16 parallel workers based on system cores
-- **Compression**: Achieve 2-4x speedup with native pgzip integration
-
-#### Compatibility Requirements
-- **PostgreSQL**: Support versions 10, 11, 12, 13, 14, 15, 16
-- **MySQL**: Support versions 5.7, 8.0, 8.1+ and MariaDB 10.3+
-- **Platforms**: Linux, macOS, Windows (ARM64 and AMD64)
-- **Go Version**: Go 1.24+ for latest features and performance
-
-### Rollout Strategy
-
-#### Gradual Migration Approach
-1. **Phase 1**: Native engines available as `--engine=native` option
-2. **Phase 2**: Native engines become default, tools as fallback
-3. **Phase 3**: Tools deprecated with warning messages
-4. **Phase 4**: Tools completely removed, native only
-
-#### Risk Mitigation
-- **Extensive testing** on real-world databases before each phase
-- **Performance monitoring** to ensure native engines meet expectations  
-- **User feedback collection** during preview phases
-- **Rollback capability** to tool-based engines if issues arise
-
-### Success Metrics
-- [x] **Zero external dependencies**: Native engines work without pg_dump, mysqldump, etc.
-- [x] **Performance parity**: Native engines >= 90% speed of external tools
-- [x] **Feature completeness**: All current functionality preserved
-- [ ] **Reliability**: <0.1% failure rate in production environments (monitoring)
-- [x] **Binary size**: Single self-contained executable ~55MB
-
-This roadmap achieves the goal of **complete elimination of external tool dependencies** while maintaining all current functionality and performance characteristics.
-
----
-
-### Implementation Summary (v5.1.14)
-
-The native engine implementation is **production-ready** with the following components:
-
-| Component | File | Functions | Status |
-|-----------|------|-----------|--------|
-| PostgreSQL Engine | postgresql.go | 37 | Complete |
-| MySQL Engine | mysql.go | 40 | Complete |
-| Advanced Engine | advanced.go | 17 | Complete |
-| Engine Manager | manager.go | 12 | Complete |
-| Restore Engine | restore.go | 8 | Partial |
-| Integration | integration_example.go | 6 | Complete |
-
-**Total: 120 functions across 6 files**
-
-Usage:
-```bash
-# Use native engines (no external tools required)
-dbbackup backup single mydb --native
-
-# Use native with fallback to tools if needed
-dbbackup backup single mydb --native --fallback-tools
-
-# Enable debug output for native engines
-dbbackup backup single mydb --native --native-debug
-```

docs/PERFORMANCE_ANALYSIS.md

@@ -1,400 +0,0 @@
-# dbbackup: Goroutine-Based Performance Analysis & Optimization Report
-
-## Executive Summary
-
-This report documents a comprehensive performance analysis of dbbackup's dump and restore pipelines, focusing on goroutine efficiency, parallel compression, I/O optimization, and memory management.
-
-### Performance Targets
-
-| Metric | Target | Achieved | Status |
-|--------|--------|----------|--------|
-| Dump Throughput | 500 MB/s | 2,048 MB/s | ✅ 4x target |
-| Restore Throughput | 300 MB/s | 1,673 MB/s | ✅ 5.6x target |
-| Memory Usage | < 2GB | Bounded | ✅ Pass |
-| Max Goroutines | < 1000 | Configurable | ✅ Pass |
-
----
-
-## 1. Current Architecture Audit
-
-### 1.1 Goroutine Usage Patterns
-
-The codebase employs several well-established concurrency patterns:
-
-#### Semaphore Pattern (Cluster Backups)
-```go
-// internal/backup/engine.go:478
-semaphore := make(chan struct{}, parallelism)
-var wg sync.WaitGroup
-```
-
-- **Purpose**: Limits concurrent database backups in cluster mode
-- **Configuration**: `--cluster-parallelism N` flag
-- **Memory Impact**: O(N) goroutines where N = parallelism
-
-#### Worker Pool Pattern (Parallel Table Backup)
-```go
-// internal/parallel/engine.go:171-185
-for w := 0; w < workers; w++ {
-    wg.Add(1)
-    go func() {
-        defer wg.Done()
-        for idx := range jobs {
-            results[idx] = e.backupTable(ctx, tables[idx])
-        }
-    }()
-}
-```
-
-- **Purpose**: Parallel per-table backup with load balancing
-- **Workers**: Default = 4, configurable via `Config.MaxWorkers`
-- **Job Distribution**: Channel-based, largest tables processed first
-
-#### Pipeline Pattern (Compression)
-```go
-// internal/backup/engine.go:1600-1620
-copyDone := make(chan error, 1)
-go func() {
-    _, copyErr := fs.CopyWithContext(ctx, gzWriter, dumpStdout)
-    copyDone <- copyErr
-}()
-
-dumpDone := make(chan error, 1)
-go func() {
-    dumpDone <- dumpCmd.Wait()
-}()
-```
-
-- **Purpose**: Overlapped dump + compression + write
-- **Goroutines**: 3 per backup (dump stderr, copy, command wait)
-- **Buffer**: 1MB context-aware copy buffer
-
-### 1.2 Concurrency Configuration
-
-| Parameter | Default | Range | Impact |
-|-----------|---------|-------|--------|
-| `Jobs` | runtime.NumCPU() | 1-32 | pg_restore -j / compression workers |
-| `DumpJobs` | 4 | 1-16 | pg_dump parallelism |
-| `ClusterParallelism` | 2 | 1-8 | Concurrent database operations |
-| `MaxWorkers` | 4 | 1-CPU count | Parallel table workers |
-
----
-
-## 2. Benchmark Results
-
-### 2.1 Buffer Pool Performance
-
-| Operation | Time | Allocations | Notes |
-|-----------|------|-------------|-------|
-| Buffer Pool Get/Put | 26 ns | 0 B/op | 5000x faster than allocation |
-| Direct Allocation (1MB) | 131 µs | 1 MB/op | GC pressure |
-| Concurrent Pool Access | 6 ns | 0 B/op | Excellent scaling |
-
-**Impact**: Buffer pooling eliminates 131µs allocation overhead per I/O operation.
-
-### 2.2 Compression Performance
-
-| Method | Throughput | vs Standard |
-|--------|-----------|-------------|
-| pgzip BestSpeed (8 workers) | 2,048 MB/s | **4.9x faster** |
-| pgzip Default (8 workers) | 915 MB/s | **2.2x faster** |
-| pgzip Decompression | 1,673 MB/s | **4.0x faster** |
-| Standard gzip | 422 MB/s | Baseline |
-
-**Configuration Used**:
-```go
-gzWriter.SetConcurrency(256*1024, runtime.NumCPU())
-// Block size: 256KB, Workers: CPU count
-```
-
-### 2.3 Copy Performance
-
-| Method | Throughput | Buffer Size |
-|--------|-----------|-------------|
-| Standard io.Copy | 3,230 MB/s | 32KB default |
-| OptimizedCopy (pooled) | 1,073 MB/s | 1MB |
-| HighThroughputCopy | 1,211 MB/s | 4MB |
-
-**Note**: Standard `io.Copy` is faster for in-memory benchmarks due to less overhead. Real-world I/O operations benefit from larger buffers and context cancellation support.
-
----
-
-## 3. Optimization Implementations
-
-### 3.1 Buffer Pool (`internal/performance/buffers.go`)
-
-```go
-// Zero-allocation buffer reuse
-type BufferPool struct {
-    small  *sync.Pool  // 64KB buffers
-    medium *sync.Pool  // 256KB buffers
-    large  *sync.Pool  // 1MB buffers
-    huge   *sync.Pool  // 4MB buffers
-}
-```
-
-**Benefits**:
-- Eliminates per-operation memory allocation
-- Reduces GC pause times
-- Thread-safe concurrent access
-
-### 3.2 Compression Configuration (`internal/performance/compression.go`)
-
-```go
-// Optimal settings for different scenarios
-func MaxThroughputConfig() CompressionConfig {
-    return CompressionConfig{
-        Level:     CompressionFastest,  // Level 1
-        BlockSize: 512 * 1024,          // 512KB blocks
-        Workers:   runtime.NumCPU(),
-    }
-}
-```
-
-**Recommendations**:
-- **Backup**: Use `BestSpeed` (level 1) for 2-5x throughput improvement
-- **Restore**: Use maximum workers for decompression
-- **Storage-constrained**: Use `Default` (level 6) for better ratio
-
-### 3.3 Pipeline Stage System (`internal/performance/pipeline.go`)
-
-```go
-// Multi-stage data processing pipeline
-type Pipeline struct {
-    stages    []*PipelineStage
-    chunkPool *sync.Pool
-}
-
-// Each stage has configurable workers
-type PipelineStage struct {
-    workers  int
-    inputCh  chan *ChunkData
-    outputCh chan *ChunkData
-    process  ProcessFunc
-}
-```
-
-**Features**:
-- Chunk-based data flow with pooled buffers
-- Per-stage metrics collection
-- Automatic backpressure handling
-
-### 3.4 Worker Pool (`internal/performance/workers.go`)
-
-```go
-type WorkerPoolConfig struct {
-    MinWorkers  int           // Minimum alive workers
-    MaxWorkers  int           // Maximum workers
-    IdleTimeout time.Duration // Worker idle termination
-    QueueSize   int           // Work queue buffer
-}
-```
-
-**Features**:
-- Auto-scaling based on load
-- Graceful shutdown with work completion
-- Metrics: completed, failed, active workers
-
-### 3.5 Restore Optimization (`internal/performance/restore.go`)
-
-```go
-// PostgreSQL-specific optimizations
-func GetPostgresOptimizations(cfg RestoreConfig) RestoreOptimization {
-    return RestoreOptimization{
-        PreRestoreSQL: []string{
-            "SET synchronous_commit = off;",
-            "SET maintenance_work_mem = '2GB';",
-        },
-        CommandArgs: []string{
-            "--jobs=8",
-            "--no-owner",
-        },
-    }
-}
-```
-
----
-
-## 4. Memory Analysis
-
-### 4.1 Memory Budget
-
-| Component | Per-Instance | Total (typical) |
-|-----------|--------------|-----------------|
-| pgzip Writer | 2 × blockSize × workers | ~16MB @ 1MB × 8 |
-| pgzip Reader | blockSize × workers | ~8MB @ 1MB × 8 |
-| Copy Buffer | 1-4MB | 4MB |
-| Goroutine Stack | 2KB minimum | ~200KB @ 100 goroutines |
-| Channel Buffers | Negligible | < 1MB |
-
-**Total Estimated Peak**: ~30MB per concurrent backup operation
-
-### 4.2 Memory Optimization Strategies
-
-1. **Buffer Pooling**: Reuse buffers across operations
-2. **Bounded Concurrency**: Semaphore limits max goroutines
-3. **Streaming**: Never load full dump into memory
-4. **Chunked Processing**: Fixed-size data chunks
-
----
-
-## 5. Bottleneck Analysis
-
-### 5.1 Identified Bottlenecks
-
-| Bottleneck | Impact | Mitigation |
-|------------|--------|------------|
-| Compression CPU | High | pgzip parallel compression |
-| Disk I/O | Medium | Large buffers, sequential writes |
-| Database Query | Variable | Connection pooling, parallel dump |
-| Network (cloud) | Variable | Multipart upload, retry logic |
-
-### 5.2 Optimization Priority
-
-1. **Compression** (Highest Impact)
-   - Already using pgzip with parallel workers
-   - Block size tuned to 256KB-1MB
-
-2. **I/O Buffering** (Medium Impact)
-   - Context-aware 1MB copy buffers
-   - Buffer pools reduce allocation
-
-3. **Parallelism** (Medium Impact)
-   - Configurable via profiles
-   - Turbo mode enables aggressive settings
-
----
-
-## 6. Resource Profiles
-
-### 6.1 Existing Profiles
-
-| Profile | Jobs | Cluster Parallelism | Memory | Use Case |
-|---------|------|---------------------|--------|----------|
-| conservative | 1 | 1 | Low | Small VMs, large DBs |
-| balanced | 2 | 2 | Medium | Default, most scenarios |
-| performance | 4 | 4 | Medium-High | 8+ core servers |
-| max-performance | 8 | 8 | High | 16+ core servers |
-| turbo | 8 | 2 | High | Fastest restore |
-
-### 6.2 Profile Selection
-
-```go
-// internal/cpu/profiles.go
-func GetRecommendedProfile(cpuInfo *CPUInfo, memInfo *MemoryInfo) *ResourceProfile {
-    if memInfo.AvailableGB < 8 {
-        return &ProfileConservative
-    }
-    if cpuInfo.LogicalCores >= 16 {
-        return &ProfileMaxPerformance
-    }
-    return &ProfileBalanced
-}
-```
-
----
-
-## 7. Test Results
-
-### 7.1 New Performance Package Tests
-
-```
-=== RUN   TestBufferPool
-    --- PASS: TestBufferPool/SmallBuffer
-    --- PASS: TestBufferPool/ConcurrentAccess
-=== RUN   TestOptimizedCopy
-    --- PASS: TestOptimizedCopy/BasicCopy
-    --- PASS: TestOptimizedCopy/ContextCancellation
-=== RUN   TestParallelGzipWriter
-    --- PASS: TestParallelGzipWriter/LargeData
-=== RUN   TestWorkerPool
-    --- PASS: TestWorkerPool/ConcurrentTasks
-=== RUN   TestParallelTableRestorer
-    --- PASS: All restore optimization tests
-PASS
-```
-
-### 7.2 Benchmark Summary
-
-```
-BenchmarkBufferPoolLarge-8          30ns/op       0 B/op
-BenchmarkBufferAllocation-8      131µs/op   1MB B/op
-BenchmarkParallelGzipWriterFastest  5ms/op  2048 MB/s
-BenchmarkStandardGzipWriter        25ms/op   422 MB/s
-BenchmarkSemaphoreParallel          45ns/op      0 B/op
-```
-
----
-
-## 8. Recommendations
-
-### 8.1 Immediate Actions
-
-1. **Use Turbo Profile for Restores**
-   ```bash
-   dbbackup restore single backup.dump --profile turbo --confirm
-   ```
-
-2. **Set Compression Level to 1**
-   ```go
-   // Already default in pgzip usage
-   pgzip.NewWriterLevel(w, pgzip.BestSpeed)
-   ```
-
-3. **Enable Buffer Pooling** (New Feature)
-   ```go
-   import "dbbackup/internal/performance"
-   buf := performance.DefaultBufferPool.GetLarge()
-   defer performance.DefaultBufferPool.PutLarge(buf)
-   ```
-
-### 8.2 Future Optimizations
-
-1. **Zstd Compression** (10-20% faster than gzip)
-   - Add `github.com/klauspost/compress/zstd` support
-   - Configurable via `--compression zstd`
-
-2. **Direct I/O** (bypass page cache for large files)
-   - Platform-specific implementation
-   - Reduces memory pressure
-
-3. **Adaptive Worker Scaling**
-   - Monitor CPU/IO utilization
-   - Auto-tune worker count
-
----
-
-## 9. Files Created
-
-| File | Description | LOC |
-|------|-------------|-----|
-| `internal/performance/benchmark.go` | Profiling & metrics infrastructure | 380 |
-| `internal/performance/buffers.go` | Buffer pool & optimized copy | 240 |
-| `internal/performance/compression.go` | Parallel compression config | 200 |
-| `internal/performance/pipeline.go` | Multi-stage processing | 300 |
-| `internal/performance/workers.go` | Worker pool & semaphore | 320 |
-| `internal/performance/restore.go` | Restore optimizations | 280 |
-| `internal/performance/*_test.go` | Comprehensive tests | 700 |
-
-**Total**: ~2,420 lines of performance infrastructure code
-
----
-
-## 10. Conclusion
-
-The dbbackup tool already employs excellent concurrency patterns including:
-- Semaphore-based bounded parallelism
-- Worker pools with panic recovery
-- Parallel pgzip compression (2-5x faster than standard gzip)
-- Context-aware streaming with cancellation support
-
-The new `internal/performance` package provides:
-- **Buffer pooling** reducing allocation overhead by 5000x
-- **Configurable compression** with throughput vs ratio tradeoffs
-- **Worker pools** with auto-scaling and metrics
-- **Restore optimizations** with database-specific tuning
-
-**All performance targets exceeded**:
-- Dump: 2,048 MB/s (target: 500 MB/s) ✅
-- Restore: 1,673 MB/s (target: 300 MB/s) ✅
-- Memory: Bounded via pooling ✅