CLI Options
Basic usage
murodb <database-file> [options]
Options
| Option | Description |
|---|---|
-e <SQL> | Execute SQL and exit |
--create | Create a new database |
--encryption <aes256-gcm-siv|off> | Encryption suite (off = plaintext, explicit opt-in) |
--password <PW> | Password for aes256-gcm-siv mode (prompts if omitted) |
--recovery-mode <strict|permissive> | WAL recovery policy for open |
--format <text|json> | Output format for query results |
--busy-timeout-ms <N> | Lock wait timeout in milliseconds (0 = wait indefinitely) |
--statement-timeout-ms <N> | Per-statement execution timeout in milliseconds (0 = no timeout) |
Examples
# Create a new database
murodb mydb.db --create -e "CREATE TABLE t (id BIGINT PRIMARY KEY, name VARCHAR)"
# Create plaintext DB (explicit)
murodb mydb_plain.db --create --encryption off -e "CREATE TABLE t (id BIGINT PRIMARY KEY, name VARCHAR)"
# Insert data
murodb mydb.db -e "INSERT INTO t (id, name) VALUES (1, 'hello')"
# Query
murodb mydb.db -e "SELECT * FROM t"
# Interactive REPL
murodb mydb.db
# Open with permissive recovery mode
murodb mydb.db --recovery-mode permissive
# JSON output for machine processing
murodb mydb.db --format json -e "SELECT * FROM t"
Query routing behavior
The CLI parses each statement and routes execution automatically:
- Read-only statements (
SELECT,UNION,EXPLAIN SELECT,SHOW ...,DESCRIBE) use the read path. EXPLAIN UPDATE/EXPLAIN DELETEare supported, but route according to the inner statement category.- Write and transaction-control statements (
INSERT,UPDATE,DELETE, DDL,BEGIN/COMMIT/ROLLBACK) use the write path. - While an explicit transaction is active (
BEGIN…COMMIT/ROLLBACK), all statements (includingSELECT) run with execute semantics.
Ctrl-C behavior
- In REPL input mode (while typing a statement),
Ctrl-Cclears the current input buffer. - While a statement is executing,
Ctrl-Crequests cancellation of the in-flight statement. - If cancellation succeeds, the statement returns an error and the REPL stays alive.
- In one-shot mode (
-e),Ctrl-Calso requests cancellation; the command then exits after printing the statement error.
JSON output
When using --format json, results are emitted as a single JSON object per statement.
Result envelope
type- One ofrows,rows_affected,ok, orerrorcolumns- Column names in result order (only forrows)rows- Array of row arrays in column order (only forrows)row_count- Number of rows (only forrows)rows_affected- Number of rows affected (only forrows_affected)message- Error message string (only forerror)
Example:
{"type":"rows","columns":["id","name"],"rows":[[1,"alice"]],"row_count":1}
Types
INTEGER
Numbers are emitted as JSON numbers.
FLOAT
Finite values are emitted as JSON numbers. Non-finite values are emitted as JSON strings.
DATE
YYYY-MM-DD
DATETIME
ISO 8601 YYYY-MM-DDTHH:MM:SS
TIMESTAMP
ISO 8601 YYYY-MM-DDTHH:MM:SS
VARCHAR
JSON strings with standard escaping.
VARBINARY
Base64 string (standard alphabet with = padding), for example q80=.
NULL
null
WAL inspection
WAL inspection is handled by a dedicated command so the query CLI stays simple:
murodb-wal-inspect mydb.db --wal mydb.wal --recovery-mode permissive
See WAL Inspection for exit codes and JSON schema.
Rekey Command
Use the dedicated command for password rotation:
murodb-rekey mydb.db
The command prompts for current password, new password, and confirmation via TTY.
Security Notes
- Prefer interactive password prompt over
--passwordto reduce secret exposure in process lists/history. - Password rotation uses
murodb-rekey(interactive prompt), not SQL text.