Add tests, schema sync safeguards, and query/handler improvements

- Add bun test suite: SQL generator and value unit tests, plus MariaDB
  integration tests gated on BUN_MARIADB_TEST_DB
- schema: add --dry-run and require confirmation (or --yes) before
  dropping tables/columns; block unapproved destructive statements
- Always AND targetId with the query, regardless of searchOperator
- Initialize lazily on first call; init throws instead of exiting
- Generate IN (?, ?, ...) lists for IN / NOT IN
- Share value binding between insert and update (booleans, embeddings,
  function values, "" -> NULL for non-text columns)
- Keep Buffers and convert BigInt/Date without a JSON round-trip
- DbSQL: report success for empty SELECT results
- Run update() in a transaction with row locking
- Key the client cache on the full connection config
- Consolidate identifier quoting, drop dead code, merge column lookup
- Read CLI version from package.json, pin @types/bun, chmod CLI on compile
- Rebuild dist

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dist/functions/grab-mariadb-client.js

@@ -2,29 +2,44 @@ import path from "path";
 import grabDirNames from "../data/grab-dir-names";
 import {} from "../types";
 import { SQL } from "bun";
-/** Reuse one client per database name to avoid exhausting MariaDB connections. */
+/** Reuse one client per distinct connection config to avoid exhausting MariaDB connections. */
 const clientCache = new Map();
+/**
+ * Cache key covering everything that affects the connection, not just the
+ * database name.
+ */
+export function mariadbClientCacheKey(config) {
+    return JSON.stringify({
+        db_name: config?.db_name || "__default__",
+        db_config: config?.db_config || null,
+        ssl_ca: config?.ssl_ca || null,
+        ssl_reject_unauthorized: config?.ssl_reject_unauthorized ?? null,
+    });
+}
 export default function grabMariaDBClient({ config, }) {
-    const cacheKey = config.db_name || "__default__";
+    const cacheKey = mariadbClientCacheKey(config);
     const cached = clientCache.get(cacheKey);
     if (cached) {
         return cached;
     }
-    // Prefer the process-wide client when it matches the requested database
+    // Prefer the process-wide client when it was created from the same config
     if (global.MARIADB_CLIENT &&
-        (!global.CONFIG?.db_name || global.CONFIG.db_name === config.db_name)) {
+        global.CONFIG &&
+        mariadbClientCacheKey(global.CONFIG) === cacheKey) {
         clientCache.set(cacheKey, global.MARIADB_CLIENT);
         return global.MARIADB_CLIENT;
     }
     const { ROOT_DIR } = grabDirNames();
     try {
+        // Verify the server certificate unless explicitly disabled
+        const rejectUnauthorized = config.ssl_reject_unauthorized !== false;
         const tls = config.ssl_ca
             ? {
                 ca: Bun.file(path.resolve(ROOT_DIR, config.ssl_ca)),
-                rejectUnauthorized: false,
+                rejectUnauthorized,
             }
             : {
-                rejectUnauthorized: false,
+                rejectUnauthorized,
             };
         const MariaDBClient = new SQL({
             hostname: process.env.BUN_MARIADB_SERVER_HOST,
@@ -34,8 +49,8 @@ export default function grabMariaDBClient({ config, }) {
             port: process.env.BUN_MARIADB_SERVER_PORT
                 ? Number(process.env.BUN_MARIADB_SERVER_PORT)
                 : undefined,
-            ...config.db_config,
             tls,
+            ...config.db_config,
             adapter: "mariadb",
         });
         clientCache.set(cacheKey, MariaDBClient);