Updated dbtool to support MTA files

[jschick04]

No description provided.

[Copilot]

Pull request overview

Updates the EventDbTool CLI to treat provider data as coming from a “provider source” (local machine, .db, exported .evtx + sibling LocaleMetaData/*.MTA, or a folder containing these), enabling workflows that rely on MTA-only metadata rather than local registry/DLL resolution.

Changes:

• Replaces showlocal/showdatabase with a unified show command that can read from .db, .evtx+LocaleMetaData, or folders.
• Adds ProviderSource and MtaProviderSource helpers to discover/load providers from .db/.evtx/folders.
• Extends create, merge, and diff to accept these broader provider sources.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/EventLogExpert.EventDbTool/ShowLocalCommand.cs	Removed legacy local-only “show” command in favor of unified source handling.
src/EventLogExpert.EventDbTool/ShowDatabaseCommand.cs	Removed legacy DB-only “show” command in favor of unified source handling.
src/EventLogExpert.EventDbTool/ShowCommand.cs	New unified show command supporting local, .db, .evtx+MTA, and folders.
src/EventLogExpert.EventDbTool/ProviderSource.cs	New abstraction for enumerating/loading provider details from .db/.evtx/folders.
src/EventLogExpert.EventDbTool/MtaProviderSource.cs	New logic to discover provider names from .evtx and resolve via sibling LocaleMetaData/*.MTA only.
src/EventLogExpert.EventDbTool/Program.cs	Switches root command registration to the new unified show command.
src/EventLogExpert.EventDbTool/MergeDatabaseCommand.cs	Allows merging from any provider source; adds case-insensitive match/removal behavior.
src/EventLogExpert.EventDbTool/DiffDatabaseCommand.cs	Allows diffing two provider sources and generating a .db containing providers only in the second source.
src/EventLogExpert.EventDbTool/DbToolCommand.cs	Adds LoadLocalProviders helper and updates output to include Parameters count.
src/EventLogExpert.EventDbTool/CreateDatabaseCommand.cs	Adds optional source argument and expands skip/filter logic to support non-DB inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/EventLogExpert.EventDbTool/Program.cs:26

• The CLI subcommands showlocal and showdatabase have been removed and replaced with show. This is a breaking change for any existing scripts/automation that call the old commands. Consider keeping showlocal/showdatabase as backward-compatible aliases (potentially hidden) that forward to show, or document the breaking change prominently in help/release notes.

        RootCommand rootCommand = new("Tool used to create and modify databases for use with EventLogExpert");

        rootCommand.Subcommands.Add(ShowCommand.GetCommand());
        rootCommand.Subcommands.Add(CreateDatabaseCommand.GetCommand());
        rootCommand.Subcommands.Add(MergeDatabaseCommand.GetCommand());
        rootCommand.Subcommands.Add(DiffDatabaseCommand.GetCommand());
        rootCommand.Subcommands.Add(UpgradeDatabaseCommand.GetCommand());

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

MergeDatabase eagerly materializes all ProviderDetails from the source (ProviderSource.LoadProviders(...).ToList()) before checking which provider names already exist in the target. When --overwrite is not set and the overlap is large (especially for .evtx+MTA sources where resolving a provider is expensive), this does unnecessary work and can significantly slow the command.

Consider loading only the source provider names first (ProviderSource.LoadProviderNames) to compute the overlap, then (when overwriteProviders is false) call ProviderSource.LoadProviders again with skipProviderNames set to the target overlap so skipped providers are never resolved.

[Copilot]

This change removes the showlocal and showdatabase subcommands from the CLI and replaces them with a single show command. If users have scripts or docs referencing the old subcommands, this is a breaking change.

Consider keeping showlocal/showdatabase as deprecated aliases that forward to show (with/without a source argument), or at least add explicit migration guidance in the command descriptions/help output.

Suggested change

	RootCommand rootCommand = new("Tool used to create and modify databases for use with EventLogExpert");
	RootCommand rootCommand = new(
	"Tool used to create and modify databases for use with EventLogExpert. " +
	"Migration note: the previous 'showlocal' and 'showdatabase' commands have been replaced by 'show'. " +
	"Update any scripts or documentation that still reference the old command names.");