Bug fixes:
- Fix eval chomp to remove only last newline (matching Perl behavior)
- Fix multiplex to merge bucket keys into output records (Perl parity)
- Fix collate --cube flag to actually generate ALL combinations
- Refactor chain from buffered spawnSync to streaming Bun.spawn pipes
New features:
- Add --shell flag to generate for shell command execution
- Add PostgreSQL and MySQL support to todb (matching fromdb)
- Add --woothee user agent parsing to fromapache
- Add comprehensive packet detail parsing to fromtcpdump (MAC, IP, TCP, UDP, DNS, ARP)
- Add multi-unit duration parsing and chrono-node date support to normalizetime
- Add default UID-to-username conversion to fromps
- Add --show-deaggregator, --dldeaggregator, and deaggregator registry to decollate
- Add Ord2Bivariate and Ord2Univariate statistical aggregators
- Add * postfix sort documentation and tests for ALL-to-end sorting
Test coverage (~190 new tests):
- xform: 4 → 46 tests (context ops, pre/post snippets, push helpers, edge cases)
- collate: +22 tests (cube, domain language, null handling, no-bucket, mr-agg, ii-agg)
- fromtcpdump: +28 tests (all packet types with synthetic fixtures)
- decollate: +17 tests (unhash, unarray, chained, show-deagg, dl-deagg)
- todb: +17 tests (multi-DB option parsing, SQL generation)
- chain: +12 tests (shell streaming, early exit, error handling, edge cases)
- toptable: +11 tests (record mode, KeyGroups, ordering, pins)
- normalizetime: +8 tests (multi-unit durations, chrono-node)
- generate: +7 tests (shell mode execution)
- fromps: +4 tests (UID conversion)
- annotate, eval, fromcsv, fromxml, multiplex, sort: +1-4 tests each
- statistical aggregators: +12 tests (Ord2Uni, Ord2Biv)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Summary
Test plan
bun test— 1886 pass, 12 skip, 0 failbunx oxlint— 0 errors (2 pre-existing warnings)tsc --noEmit— cleancheck-no-private— clean🤖 Generated with Claude Code