@carllee1983/dbcli 1.37.1 → 1.39.1

package/dist/cli.mjs

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "1.37.1",
+    version: "1.39.1",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -8809,8 +8809,9 @@ class BlacklistManager {
 }
 
 // src/core/saved-queries/types.ts
-var SavedQueryError;
+var SUPPORTED_CHART_TYPES, SavedQueryError;
 var init_types2 = __esm(() => {
+  SUPPORTED_CHART_TYPES = ["line", "bar", "area", "pie"];
   SavedQueryError = class SavedQueryError extends Error {
     code;
     file;
@@ -9577,7 +9578,7 @@ function parseFrontmatter(yaml, input) {
   const tags = Array.isArray(raw.tags) ? raw.tags.map(String) : [];
   const index = typeof raw.index === "string" ? raw.index : undefined;
   const intent = normaliseIntent(raw.intent, input);
-  const visual = normaliseVisual(raw.visual);
+  const visual = normaliseVisual(raw.visual, input);
   const target = typeof raw.target === "string" ? raw.target : undefined;
   const operation = raw.operation === "find" || raw.operation === "aggregate" ? raw.operation : undefined;
   const verify = normaliseVerify(raw.verify, input);
@@ -9599,7 +9600,7 @@ function parseFrontmatter(yaml, input) {
     warnings
   };
 }
-function normaliseVisual(value) {
+function normaliseVisual(value, input) {
   if (value === undefined || value === null || typeof value !== "object")
     return;
   const raw = value;
@@ -9625,6 +9626,9 @@ function normaliseVisual(value) {
       if (typeof item === "object" && item !== null) {
         const c2 = item;
         if (typeof c2.type === "string" && typeof c2.x === "string" && Array.isArray(c2.y)) {
+          if (!SUPPORTED_CHART_TYPES.includes(c2.type)) {
+            throw new SavedQueryError(`Snippet '${input.key}' has invalid chart type '${c2.type}' (supported: ${SUPPORTED_CHART_TYPES.join(", ")})`, "PARSE_ERROR", input.file);
+          }
           charts.push({
             type: c2.type,
             title: typeof c2.title === "string" ? c2.title : undefined,
@@ -23087,7 +23091,7 @@ var init_capabilities = __esm(() => {
       queries: cap("limited", "local-write", "Snippet management works with Redis-specific saved-query limitations."),
       insert: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
       update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
-      delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
+      delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
       export: cap("unsupported", "none", "Redis export is not supported."),
       blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
       check: cap("unsupported", "none", "Data health check is SQL-only."),
@@ -24863,6 +24867,17 @@ class RedisAdapter {
     const regexes = rules.map((p) => globToRegex(p));
     return keys.filter((k) => !regexes.some((r) => r.test(k))).map((name2) => ({ name: name2 }));
   }
+  async sampleKeyNames(limit) {
+    const client = this.requireClient();
+    const keys = await scanAllKeys(client, "*", limit, limit);
+    const truncated = keys.length >= limit;
+    const rules = this.blacklistRules;
+    if (rules.length === 0)
+      return { names: keys, truncated };
+    const regexes = rules.map((p) => globToRegex(p));
+    const names = keys.filter((k) => !regexes.some((r) => r.test(k)));
+    return { names, truncated };
+  }
   async getDbSize() {
     const client = this.requireClient();
     const reply = await client.send("DBSIZE", []);
@@ -25145,7 +25160,7 @@ function parseRedisCommand(input) {
     push();
   return tokens;
 }
-async function scanAllKeys(client, pattern, count) {
+async function scanAllKeys(client, pattern, count, maxKeys = 1e5) {
   const seen = new Set;
   let cursor = "0";
   do {
@@ -25160,7 +25175,7 @@ async function scanAllKeys(client, pattern, count) {
     for (const k of batch)
       seen.add(k);
     cursor = next;
-    if (seen.size >= 1e5)
+    if (seen.size >= maxKeys)
       break;
   } while (cursor !== "0");
   return Array.from(seen);
@@ -28927,6 +28942,7 @@ var init_assert_artifact = __esm(() => {
     "assertion",
     "migration",
     "backfill",
+    "table",
     "manual"
   ];
   AssertArtifactError = class AssertArtifactError extends Error {
@@ -92930,12 +92946,277 @@ var init_rollback = __esm(() => {
     note: "Preflight guards ran before post-rollback read-back verification."
   };
 });
+
+// src/core/verify/constraint.ts
+function normalizeConstraintCheck(raw) {
+  const check2 = raw ?? "";
+  if (!ALLOWED_CONSTRAINT_CHECKS.includes(check2)) {
+    throw new VerifyInputError(`Invalid --check '${check2}'. Allowed: ${ALLOWED_CONSTRAINT_CHECKS.join(", ")}`);
+  }
+  return check2;
+}
+function toColumns(raw) {
+  if (raw === undefined || raw === null)
+    return [];
+  const arr = Array.isArray(raw) ? raw : [raw];
+  return arr.map((c2) => requireNonEmpty(c2, "--column"));
+}
+function parseReferences(raw) {
+  const ref = requireNonEmpty(raw, "--references");
+  const parts = ref.split(".").map((p) => p.trim());
+  if (parts.length < 2 || parts.some((p) => p.length === 0)) {
+    throw new VerifyInputError(`--references must be '<table>.<column>' (got '${ref}')`);
+  }
+  const column = parts.pop();
+  const table = parts.join(".");
+  return { table, column };
+}
+function parseBaseline(raw) {
+  if (raw === undefined || raw === null || raw === "")
+    return 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    throw new VerifyInputError(`--baseline must be a non-negative integer (got '${String(raw)}')`);
+  }
+  return n;
+}
+function normalizeConstraintInput(raw) {
+  const check2 = normalizeConstraintCheck(raw.check);
+  const table = requireNonEmpty(raw.table, "--table");
+  const format = normalizeFormat(raw.format);
+  const columns = toColumns(raw.column);
+  const violationQueryRaw = raw.violationQuery;
+  const hasViolationQuery = typeof violationQueryRaw === "string" && violationQueryRaw.trim().length > 0;
+  let references;
+  if (check2 === "fk") {
+    if (columns.length !== 1) {
+      throw new VerifyInputError("--check fk requires exactly one --column (the child FK column).");
+    }
+    references = parseReferences(raw.references);
+    if (hasViolationQuery) {
+      throw new VerifyInputError("--violation-query is only valid with --check custom.");
+    }
+  } else if (check2 === "not-null" || check2 === "unique") {
+    if (columns.length < 1) {
+      throw new VerifyInputError(`--check ${check2} requires at least one --column.`);
+    }
+    if (raw.references !== undefined) {
+      throw new VerifyInputError("--references is only valid with --check fk.");
+    }
+    if (hasViolationQuery) {
+      throw new VerifyInputError("--violation-query is only valid with --check custom.");
+    }
+  } else {
+    if (!hasViolationQuery) {
+      throw new VerifyInputError("--check custom requires --violation-query.");
+    }
+    if (columns.length > 0) {
+      throw new VerifyInputError("--column is not valid with --check custom.");
+    }
+    if (raw.references !== undefined) {
+      throw new VerifyInputError("--references is only valid with --check fk.");
+    }
+  }
+  const subjectNameRaw = raw.subjectName;
+  const summaryRaw = raw.summary;
+  return {
+    table,
+    check: check2,
+    columns,
+    ...references ? { references } : {},
+    ...check2 === "custom" ? { violationQuery: violationQueryRaw.trim() } : {},
+    allowPreexisting: raw.allowPreexisting === true,
+    baseline: parseBaseline(raw.baseline),
+    afterWrite: raw.afterWrite === true,
+    format,
+    ...subjectNameRaw && subjectNameRaw.trim().length > 0 ? { subjectName: subjectNameRaw.trim() } : {},
+    ...summaryRaw && summaryRaw.trim().length > 0 ? { summary: summaryRaw.trim() } : {}
+  };
+}
+function buildConstraintSubject(input) {
+  return {
+    kind: "table",
+    name: input.subjectName ?? input.table,
+    command: "verify constraint"
+  };
+}
+function buildConstraintAfterWriteCommand(input, baseline) {
+  const flags = [`--check ${input.check}`, `--table ${shellQuote2(input.table)}`];
+  if (input.check === "fk") {
+    flags.push(`--column ${shellQuote2(input.columns[0])}`);
+    flags.push(`--references ${shellQuote2(`${input.references.table}.${input.references.column}`)}`);
+  } else if (input.check === "custom") {
+    flags.push(`--violation-query ${shellQuote2(input.violationQuery)}`);
+  } else {
+    for (const c2 of input.columns)
+      flags.push(`--column ${shellQuote2(c2)}`);
+  }
+  if (input.subjectName)
+    flags.push(`--subject-name ${shellQuote2(input.subjectName)}`);
+  if (input.summary)
+    flags.push(`--summary ${shellQuote2(input.summary)}`);
+  if (input.format !== "table")
+    flags.push(`--format ${input.format}`);
+  if (baseline !== undefined && baseline > 0) {
+    flags.push("--allow-preexisting", `--baseline ${baseline}`);
+  }
+  return renderAfterWriteCommand("constraint", flags);
+}
+async function runConstraintGuards(runners) {
+  return runGuardSequence([
+    ["blacklist", () => runners.blacklistGuard()],
+    ["schema", () => runners.schemaGuard()],
+    ["violation-query-readonly", () => runners.violationReadonlyGuard()]
+  ]);
+}
+function constraintDefaultSummary(status2, check2, table) {
+  switch (status2) {
+    case "verified":
+      return `Constraint '${check2}' holds on ${table} (violation count within threshold).`;
+    case "not_verified":
+      return `Constraint '${check2}' is violated on ${table} (violation count exceeds threshold).`;
+    case "blocked":
+      return `Constraint '${check2}' verification was blocked before the violation count on ${table}.`;
+    default:
+      return `Constraint '${check2}' verification could not produce a trustworthy verdict on ${table}.`;
+  }
+}
+async function runConstraintPreflight(input, runners) {
+  const guards = await runConstraintGuards(runners);
+  const ready = allGuardsPassed(guards, 3);
+  let baseline;
+  if (ready) {
+    const outcome = await runners.runViolationCount();
+    if (outcome.ran && typeof outcome.count === "number")
+      baseline = outcome.count;
+  }
+  return {
+    scenario: "constraint",
+    mode: "preflight",
+    status: ready ? "ready" : "blocked",
+    check: input.check,
+    table: input.table,
+    violationSql: runners.violationSql,
+    ...baseline !== undefined ? { baseline } : {},
+    guards,
+    afterWriteCommand: buildConstraintAfterWriteCommand(input, baseline)
+  };
+}
+async function runConstraintAfterWrite(input, runners, clock = {}) {
+  const subject = buildConstraintSubject(input);
+  const guards = await runConstraintGuards(runners);
+  if (!allGuardsPassed(guards, 3)) {
+    const failed = guards.find((g) => g.status === "failed");
+    const blockedReason = failed?.reason ?? "A required guard failed before the violation count.";
+    const artifact3 = buildVerificationArtifact({
+      status: "blocked",
+      subject,
+      summary: input.summary ?? constraintDefaultSummary("blocked", input.check, input.table),
+      evidence: [CONSTRAINT_TASK_PACK_EVIDENCE],
+      blockedReason,
+      now: clock.now,
+      idFactory: clock.idFactory
+    });
+    return {
+      scenario: "constraint",
+      mode: "after-write",
+      status: "blocked",
+      check: input.check,
+      table: input.table,
+      guards,
+      artifact: artifact3,
+      blockedReason
+    };
+  }
+  const outcome = await runners.runViolationCount();
+  const threshold = input.allowPreexisting ? input.baseline : 0;
+  const assertionOutcome = outcome.ran && typeof outcome.count === "number" ? { ran: true, pass: outcome.count <= threshold, auditRef: outcome.auditRef } : { ran: false, reason: outcome.reason, auditRef: outcome.auditRef };
+  const status2 = mapAssertionToStatus(assertionOutcome);
+  const evidence2 = {
+    kind: "assert",
+    command: `constraint:${input.check} <${redactSqlForEvidence(runners.violationSql)}> threshold <=${threshold}`,
+    exitCode: status2 === "verified" ? 0 : 1,
+    ...outcome.auditRef ? { auditRef: outcome.auditRef } : {},
+    ...status2 === "indeterminate" && outcome.reason ? { note: outcome.reason } : {}
+  };
+  const artifact2 = buildVerificationArtifact({
+    status: status2,
+    subject,
+    summary: input.summary ?? constraintDefaultSummary(status2, input.check, input.table),
+    evidence: [CONSTRAINT_TASK_PACK_EVIDENCE, evidence2],
+    ...status2 === "indeterminate" && outcome.reason ? { blockedReason: outcome.reason } : {},
+    now: clock.now,
+    idFactory: clock.idFactory
+  });
+  return {
+    scenario: "constraint",
+    mode: "after-write",
+    status: status2,
+    check: input.check,
+    table: input.table,
+    guards,
+    ...outcome.ran && typeof outcome.count === "number" ? { assertion: { violations: outcome.count, threshold, passed: status2 === "verified" } } : {},
+    artifact: artifact2
+  };
+}
+var ALLOWED_CONSTRAINT_CHECKS, CONSTRAINT_TASK_PACK_EVIDENCE;
+var init_constraint = __esm(() => {
+  init_scenario();
+  init_verification();
+  init_scenario();
+  ALLOWED_CONSTRAINT_CHECKS = ["fk", "not-null", "unique", "custom"];
+  CONSTRAINT_TASK_PACK_EVIDENCE = {
+    kind: "task-pack-plan",
+    taskName: "constraint-verify",
+    note: "Preflight guards ran before the read-only violation count."
+  };
+});
+
+// src/core/verify/constraint-query.ts
+function quoteIdent(name2, engine) {
+  const useBacktick = engine === "mysql" || engine === "mariadb";
+  const q = useBacktick ? "`" : '"';
+  const esc = (seg) => `${q}${seg.split(q).join(q + q)}${q}`;
+  return name2.split(".").map((seg) => esc(seg.trim())).join(".");
+}
+function buildNotNullViolationQuery(a) {
+  const where = a.columns.map((c2) => `${quoteIdent(c2, a.engine)} IS NULL`).join(" OR ");
+  return `SELECT COUNT(*) AS violation_count FROM ${quoteIdent(a.table, a.engine)} WHERE ${where}`;
+}
+function buildUniqueViolationQuery(a) {
+  const cols = a.columns.map((c2) => quoteIdent(c2, a.engine)).join(", ");
+  return `SELECT COUNT(*) AS violation_count FROM (SELECT 1 FROM ${quoteIdent(a.table, a.engine)} GROUP BY ${cols} HAVING COUNT(*) > 1) AS dups`;
+}
+function buildFkViolationQuery(a) {
+  const col = quoteIdent(a.column, a.engine);
+  const ref = quoteIdent(a.refColumn, a.engine);
+  return `SELECT COUNT(*) AS violation_count FROM ${quoteIdent(a.table, a.engine)} AS c LEFT JOIN ${quoteIdent(a.refTable, a.engine)} AS p ON c.${col} = p.${ref} WHERE c.${col} IS NOT NULL AND p.${ref} IS NULL`;
+}
+function buildViolationQuery(input, engine) {
+  switch (input.check) {
+    case "custom":
+      return input.violationQuery;
+    case "not-null":
+      return buildNotNullViolationQuery({ engine, table: input.table, columns: input.columns });
+    case "unique":
+      return buildUniqueViolationQuery({ engine, table: input.table, columns: input.columns });
+    case "fk":
+      return buildFkViolationQuery({
+        engine,
+        table: input.table,
+        column: input.columns[0],
+        refTable: input.references.table,
+        refColumn: input.references.column
+      });
+  }
+}
 // src/core/verify/index.ts
 var init_verify = __esm(() => {
   init_scenario();
   init_safe_backfill();
   init_migration();
   init_rollback();
+  init_constraint();
 });
 
 // src/commands/verify.ts
@@ -93197,6 +93478,96 @@ function buildRollbackRunners(ctx, input) {
     }
   };
 }
+function constraintEngineOf(system) {
+  return system;
+}
+function buildConstraintRunners(ctx, input) {
+  const { adapter, config } = ctx;
+  const blacklist = config.blacklist ?? { tables: [], columns: {} };
+  const schema = config.schema ?? {};
+  const schemaLookup = { tables: schema, cacheAvailable: Object.keys(schema).length > 0 };
+  const analyze = (sql) => analyzeQueryRisk({ sql: sql.trim(), permission: config.permission, blacklist, schemaLookup });
+  const engine = constraintEngineOf(config.connection.system);
+  const violationSql = buildViolationQuery(input, engine);
+  const columnsExist = async (table, cols) => {
+    const ts = await adapter.getTableSchema(table);
+    const present = new Set(ts.columns.map((c2) => c2.name.toLowerCase()));
+    const missing = cols.filter((c2) => !present.has(c2.trim().toLowerCase()));
+    return missing.length > 0 ? `unknown column(s) on ${table}: ${missing.join(", ")}` : null;
+  };
+  return {
+    violationSql,
+    blacklistGuard: async () => {
+      const bm = new BlacklistManager(config);
+      const targets = [input.table, ...input.references ? [input.references.table] : []];
+      for (const t2 of targets) {
+        if (bm.isTableBlacklisted(t2) && !bm.canOverrideBlacklist()) {
+          return { ok: false, reason: boundedReason(`Target table '${t2}' is blacklisted.`) };
+        }
+      }
+      return { ok: true };
+    },
+    schemaGuard: async () => {
+      try {
+        if (input.check !== "custom") {
+          const miss = await columnsExist(input.table, input.columns);
+          if (miss)
+            return { ok: false, reason: boundedReason(miss) };
+        } else {
+          await adapter.getTableSchema(input.table);
+        }
+        if (input.references) {
+          const refMiss = await columnsExist(input.references.table, [input.references.column]);
+          if (refMiss)
+            return { ok: false, reason: boundedReason(refMiss) };
+        }
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, reason: boundedReason(`schema check failed: ${e.message}`) };
+      }
+    },
+    violationReadonlyGuard: async () => {
+      const r = analyze(violationSql);
+      if (!isPlainSelectVerifyQuery(r.operation, violationSql)) {
+        return {
+          ok: false,
+          reason: boundedReason(`violation query must be a read-only plain SELECT (got ${r.operation}).`)
+        };
+      }
+      return { ok: true };
+    },
+    runViolationCount: async () => {
+      try {
+        const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
+        const executor3 = new QueryExecutor(adapter, config.permission, blacklistValidator, config, ctx.options);
+        const result = await executor3.execute(violationSql, { autoLimit: true });
+        const scalar = firstScalar(result);
+        const auditRef = await writeAuditEntry(config, "verify", ctx.options, {
+          success: true,
+          sql: violationSql
+        });
+        if (scalar === null) {
+          return {
+            ran: false,
+            reason: boundedReason("violation query returned no count"),
+            auditRef
+          };
+        }
+        const count = typeof scalar === "number" ? scalar : Number(scalar);
+        if (!Number.isFinite(count)) {
+          return {
+            ran: false,
+            reason: boundedReason(`violation count not numeric: ${scalar}`),
+            auditRef
+          };
+        }
+        return { ran: true, count, auditRef };
+      } catch (e) {
+        return { ran: false, reason: boundedReason(e.message) };
+      }
+    }
+  };
+}
 function formatPreflightTable(r) {
   const lines = [
     `Scenario:    ${r.scenario}`,
@@ -93405,6 +93776,81 @@ function buildRollbackAfterWriteJson(r, artifactPath) {
     ...r.blockedReason ? { blockedReason: r.blockedReason } : {}
   };
 }
+function formatConstraintPreflightTable(r) {
+  const lines = [
+    `Scenario:    ${r.scenario}`,
+    `Mode:        preflight`,
+    `Check:       ${r.check}`,
+    `Table:       ${r.table}`,
+    `Status:      ${r.status}`,
+    "Guards:"
+  ];
+  for (const g of r.guards) {
+    lines.push(`  - ${g.name}: ${g.status}${g.reason ? ` (${g.reason})` : ""}`);
+  }
+  if (r.baseline !== undefined)
+    lines.push("", `Baseline violations: ${r.baseline}`);
+  lines.push("", "Violation query (read-only; this command never executes a write):");
+  lines.push(`  ${r.violationSql}`);
+  lines.push("", "After-write command (run AFTER you apply your change externally):");
+  lines.push(`  ${r.afterWriteCommand}`);
+  lines.push("", "Note: default verdict requires 0 violations; add --allow-preexisting --baseline <N> to tolerate pre-existing ones.");
+  return lines.join(`
+`);
+}
+function formatConstraintAfterWriteTable(r, artifactPath) {
+  const lines = [
+    `Scenario:    ${r.scenario}`,
+    `Mode:        after-write`,
+    `Check:       ${r.check}`,
+    `Table:       ${r.table}`,
+    `Status:      ${r.status}`
+  ];
+  if (r.assertion)
+    lines.push(`Violations:  ${r.assertion.violations} (threshold <= ${r.assertion.threshold}) -> ${r.assertion.passed ? "PASS" : "FAIL"}`);
+  if (r.blockedReason)
+    lines.push(`Reason:      ${r.blockedReason}`);
+  lines.push(`Summary:     ${r.artifact.summary}`);
+  lines.push(`Artifact id: ${r.artifact.id}`);
+  if (artifactPath)
+    lines.push(`Artifact:    ${artifactPath}`);
+  lines.push("", `Next: dbcli verification show ${r.artifact.id}`);
+  return lines.join(`
+`);
+}
+function buildConstraintPreflightJson(r) {
+  return {
+    scenario: r.scenario,
+    mode: r.mode,
+    status: r.status,
+    check: r.check,
+    table: r.table,
+    violationSql: r.violationSql,
+    ...r.baseline !== undefined ? { baseline: r.baseline } : {},
+    guards: r.guards.map((g) => ({
+      name: g.name,
+      status: g.status,
+      ...g.reason ? { reason: g.reason } : {}
+    })),
+    afterWriteCommand: r.afterWriteCommand
+  };
+}
+function buildConstraintAfterWriteJson(r, artifactPath) {
+  return {
+    scenario: r.scenario,
+    mode: r.mode,
+    status: r.status,
+    check: r.check,
+    table: r.table,
+    artifact: {
+      id: r.artifact.id,
+      ...artifactPath ? { path: artifactPath } : {},
+      subject: r.artifact.subject
+    },
+    ...r.assertion ? { assertion: r.assertion } : {},
+    ...r.blockedReason ? { blockedReason: r.blockedReason } : {}
+  };
+}
 async function executeScenario(def, options, command) {
   let input;
   try {
@@ -93471,7 +93917,7 @@ function registerScenario(parent, def) {
   def.configureOptions(command);
   command.action((options, cmd) => executeScenario(def, options, cmd));
 }
-var SQL_SYSTEMS7, safeBackfillScenario, migrationScenario, rollbackScenario, BUILTIN_VERIFY_SCENARIOS, verifyCommand;
+var SQL_SYSTEMS7, safeBackfillScenario, migrationScenario, rollbackScenario, constraintScenario, BUILTIN_VERIFY_SCENARIOS, verifyCommand;
 var init_verify2 = __esm(() => {
   init_esm();
   init_adapters();
@@ -93627,10 +94073,61 @@ var init_verify2 = __esm(() => {
       return result.status === "verified" && !artifactError;
     }
   };
+  constraintScenario = {
+    name: "constraint",
+    description: "Preflight or after-write verification that a data-integrity invariant holds across your change (--check fk|not-null|unique|custom); never executes a write",
+    subjectKind: "table",
+    configureOptions(command) {
+      return command.requiredOption("--table <table>", "Table the invariant is checked on").requiredOption("--check <kind>", "Constraint kind: fk | not-null | unique | custom").option("--column <name>", "Column to check (repeatable for not-null/unique; the child FK column for fk)", (val, prev = []) => [...prev, val]).option("--references <table.column>", "Referenced <table>.<column> (required for --check fk)").option("--violation-query <sql>", "Read-only SELECT counting violations (required for --check custom)").option("--allow-preexisting", "Tolerate pre-existing violations: verified when count <= --baseline", false).option("--baseline <n>", "Baseline violation count measured at preflight (use with --allow-preexisting)").option("--after-write", "Re-run the violation count and write a verification artifact", false).option("--format <format>", "Output format: table (default) or json", "table").option("--subject-name <name>", "Optional artifact subject name (default: table)").option("--summary <text>", "Optional artifact summary override (after-write mode)");
+    },
+    normalize(options) {
+      return normalizeConstraintInput({
+        table: options.table,
+        check: options.check,
+        column: options.column,
+        references: options.references,
+        violationQuery: options.violationQuery,
+        allowPreexisting: options.allowPreexisting === true,
+        baseline: options.baseline,
+        afterWrite: options.afterWrite === true,
+        format: options.format,
+        subjectName: options.subjectName,
+        summary: options.summary
+      });
+    },
+    createRunners(context, input) {
+      return buildConstraintRunners(context, input);
+    },
+    runPreflight(input, runners) {
+      return runConstraintPreflight(input, runners);
+    },
+    runAfterWrite(input, runners) {
+      return runConstraintAfterWrite(input, runners);
+    },
+    renderPreflight(result, format) {
+      return format === "json" ? JSON.stringify(buildConstraintPreflightJson(result), null, 2) : formatConstraintPreflightTable(result);
+    },
+    artifactOf(result) {
+      return result.artifact;
+    },
+    afterWriteJson(result, artifactPath) {
+      return buildConstraintAfterWriteJson(result, artifactPath);
+    },
+    renderAfterWriteTable(result, artifactPath) {
+      return formatConstraintAfterWriteTable(result, artifactPath);
+    },
+    isPreflightReady(result) {
+      return result.status === "ready";
+    },
+    isAfterWriteVerified(result, artifactError) {
+      return result.status === "verified" && !artifactError;
+    }
+  };
   BUILTIN_VERIFY_SCENARIOS = [
     safeBackfillScenario,
     migrationScenario,
-    rollbackScenario
+    rollbackScenario,
+    constraintScenario
   ];
   verifyCommand = new Command("verify").description("Run verification scenarios (preflight or after-write). Never executes writes.");
   for (const scenario2 of BUILTIN_VERIFY_SCENARIOS) {
@@ -95813,32 +96310,6 @@ var init_meta_commands = __esm(() => {
   VALID_FORMATS = ["table", "json", "csv"];
 });
 
-// src/core/repl/command-registry.ts
-var exports_command_registry = {};
-__export(exports_command_registry, {
-  setReplCommandNames: () => setReplCommandNames,
-  isReplCommandKnown: () => isReplCommandKnown,
-  getReplCommandNames: () => getReplCommandNames,
-  REPL_DENYLIST: () => REPL_DENYLIST
-});
-function setReplCommandNames(input) {
-  const allowed = input.filter((n) => !REPL_DENYLIST.has(n));
-  names = allowed;
-  known = new Set(allowed);
-}
-function getReplCommandNames() {
-  return names;
-}
-function isReplCommandKnown(name2) {
-  return known.has(name2);
-}
-var REPL_DENYLIST, names, known;
-var init_command_registry = __esm(() => {
-  REPL_DENYLIST = new Set(["shell"]);
-  names = [];
-  known = new Set;
-});
-
 // src/core/repl/command-dispatcher.ts
 function parseCommandLine(input) {
   const trimmed = input.trim();
@@ -95874,12 +96345,9 @@ function splitRespectingQuotes(input) {
   }
   return tokens;
 }
-function isKnownCommand(name2) {
-  return isReplCommandKnown(name2);
+function isKnownCommand(name2, commandNames) {
+  return commandNames.includes(name2);
 }
-var init_command_dispatcher = __esm(() => {
-  init_command_registry();
-});
 
 // src/core/repl/history-manager.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
@@ -96006,7 +96474,7 @@ class ReplEngine {
   }
   async handleCommand(input) {
     const parsed = parseCommandLine(input);
-    if (!isKnownCommand(parsed.command)) {
+    if (!isKnownCommand(parsed.command, this.context.commandNames)) {
       if (this.context.system === "redis") {
         this.history.add(input);
         return this.executeSql(input);
@@ -96149,7 +96617,6 @@ var import_picocolors3;
 var init_repl_engine = __esm(() => {
   init_input_classifier();
   init_meta_commands();
-  init_command_dispatcher();
   init_history_manager();
   init_permission_guard();
   init_query_result_formatter();
@@ -96197,7 +96664,7 @@ function createCompleter(ctx) {
     }
     const words = trimmed.split(/\s+/);
     if (words.length === 1) {
-      const cmdHits = matchWithSuffix([...getReplCommandNames()], lastWord);
+      const cmdHits = matchWithSuffix([...ctx.commandNames], lastWord);
       const sqlHits = matchWithSuffix([...SQL_KEYWORDS_FOR_COMPLETION], lastWord);
       return [[...cmdHits[0], ...sqlHits[0]], lastWord];
     }
@@ -96250,7 +96717,6 @@ function matchWithSuffix(candidates, prefix) {
 var REDIS_COMMANDS, TABLE_POSITION_KEYWORDS, COMMANDS_TAKING_TABLE_ARG;
 var init_completer = __esm(() => {
   init_types10();
-  init_command_registry();
   init_command_metadata();
   REDIS_COMMANDS = Object.keys(REDIS_COMMAND_TABLE);
   TABLE_POSITION_KEYWORDS = new Set([
@@ -96439,6 +96905,20 @@ var init_es_shell = __esm(() => {
   import_picocolors4 = __toESM(require_picocolors(), 1);
 });
 
+// src/core/repl/command-registry.ts
+var exports_command_registry = {};
+__export(exports_command_registry, {
+  deriveReplCommandNames: () => deriveReplCommandNames,
+  REPL_DENYLIST: () => REPL_DENYLIST
+});
+function deriveReplCommandNames(topLevel) {
+  return topLevel.filter((n) => !REPL_DENYLIST.has(n));
+}
+var REPL_DENYLIST;
+var init_command_registry = __esm(() => {
+  REPL_DENYLIST = new Set(["shell"]);
+});
+
 // src/commands/shell.ts
 import { createInterface as createInterface3 } from "readline";
 import { join as join32 } from "path";
@@ -96463,6 +96943,14 @@ async function populateMongoColumns(mongoAdapter, collectionNames, threshold = M
   }
   return columnsByTable;
 }
+async function populateRedisKeyCompletion(adapter, limit = REDIS_COMPLETION_KEY_LIMIT) {
+  try {
+    const { names, truncated } = await adapter.sampleKeyNames(limit);
+    return { tableNames: names, truncated };
+  } catch {
+    return { tableNames: [], truncated: false };
+  }
+}
 async function runShell(options, configPath) {
   let config;
   try {
@@ -96490,9 +96978,12 @@ async function runShell(options, configPath) {
   let tableNames = [];
   let columnsByTable = {};
   if (isRedis) {
-    const keys = await adapter.listTables();
-    tableNames = keys.map((k) => k.name);
+    const completion = await populateRedisKeyCompletion(redisInner);
+    tableNames = completion.tableNames;
     columnsByTable = {};
+    if (completion.truncated) {
+      console.error(import_picocolors5.default.dim(`Redis shell: large keyspace; tab completion limited to the first ${REDIS_COMPLETION_KEY_LIMIT} keys.`));
+    }
   } else if (isMongoDB) {
     const collections = await adapter.listTables();
     tableNames = collections.map((collection) => collection.name);
@@ -96512,17 +97003,18 @@ async function runShell(options, configPath) {
       }
     }
   }
+  const { buildProgram } = await Promise.resolve().then(() => (init_program(), exports_program));
+  const { buildCompletionTree: buildCompletionTree2, listTopLevelCommandNames: listTopLevelCommandNames2 } = await Promise.resolve().then(() => exports_command_tree);
+  const { deriveReplCommandNames: deriveReplCommandNames2 } = await Promise.resolve().then(() => (init_command_registry(), exports_command_registry));
+  const commandNames = deriveReplCommandNames2(listTopLevelCommandNames2(buildCompletionTree2(buildProgram())));
   const context = {
     configPath,
     permission: config.permission,
     system: config.connection.system,
     tableNames,
-    columnsByTable
+    columnsByTable,
+    commandNames
   };
-  const { buildProgram } = await Promise.resolve().then(() => (init_program(), exports_program));
-  const { buildCompletionTree: buildCompletionTree2, listTopLevelCommandNames: listTopLevelCommandNames2 } = await Promise.resolve().then(() => exports_command_tree);
-  const { setReplCommandNames: setReplCommandNames2 } = await Promise.resolve().then(() => (init_command_registry(), exports_command_registry));
-  setReplCommandNames2(listTopLevelCommandNames2(buildCompletionTree2(buildProgram())));
   const engine = new ReplEngine(adapter, context, HISTORY_PATH, config);
   const complete = createCompleter(context);
   console.error(import_picocolors5.default.bold(t_vars("shell.welcome", {
@@ -96612,7 +97104,7 @@ async function runBatchSession(engine, input) {
     }
   }
 }
-var import_picocolors5, HISTORY_PATH, MONGO_COMPLETION_EAGER_THRESHOLD = 20, shellCommand;
+var import_picocolors5, HISTORY_PATH, MONGO_COMPLETION_EAGER_THRESHOLD = 20, REDIS_COMPLETION_KEY_LIMIT = 1000, shellCommand;
 var init_shell3 = __esm(() => {
   init_esm();
   init_config();
@@ -96730,30 +97222,30 @@ class PostgreSQLDDLGenerator {
   dropIndex(indexName, _table) {
     return { sql: `DROP INDEX ${q(indexName)};`, warnings: [] };
   }
-  addConstraint(constraint) {
-    const t2 = q(constraint.table);
+  addConstraint(constraint2) {
+    const t2 = q(constraint2.table);
     const warnings = [];
-    switch (constraint.type) {
+    switch (constraint2.type) {
       case "foreign_key": {
-        const name2 = constraint.name || `fk_${constraint.table}_${constraint.column}`;
-        const onDelete = constraint.onDelete ? ` ON DELETE ${constraint.onDelete.toUpperCase().replace("_", " ")}` : "";
+        const name2 = constraint2.name || `fk_${constraint2.table}_${constraint2.column}`;
+        const onDelete = constraint2.onDelete ? ` ON DELETE ${constraint2.onDelete.toUpperCase().replace("_", " ")}` : "";
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} FOREIGN KEY (${q(constraint.column)}) REFERENCES ${q(constraint.references.table)}(${q(constraint.references.column)})${onDelete};`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} FOREIGN KEY (${q(constraint2.column)}) REFERENCES ${q(constraint2.references.table)}(${q(constraint2.references.column)})${onDelete};`,
           warnings
         };
       }
       case "unique": {
-        const name2 = constraint.name || `uq_${constraint.table}_${constraint.columns.join("_")}`;
-        const cols = constraint.columns.map(q).join(", ");
+        const name2 = constraint2.name || `uq_${constraint2.table}_${constraint2.columns.join("_")}`;
+        const cols = constraint2.columns.map(q).join(", ");
         return {
           sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} UNIQUE (${cols});`,
           warnings
         };
       }
       case "check": {
-        const name2 = constraint.name || `ck_${constraint.table}`;
+        const name2 = constraint2.name || `ck_${constraint2.table}`;
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} CHECK (${constraint.expression});`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q(name2)} CHECK (${constraint2.expression});`,
           warnings
         };
       }
@@ -96903,30 +97395,30 @@ class MySQLDDLGenerator {
       warnings: table ? [] : ["MySQL requires ON <table> \u2014 specify table for this operation"]
     };
   }
-  addConstraint(constraint) {
-    const t2 = q2(constraint.table);
+  addConstraint(constraint2) {
+    const t2 = q2(constraint2.table);
     const warnings = [];
-    switch (constraint.type) {
+    switch (constraint2.type) {
       case "foreign_key": {
-        const name2 = constraint.name || `fk_${constraint.table}_${constraint.column}`;
-        const onDelete = constraint.onDelete ? ` ON DELETE ${constraint.onDelete.toUpperCase().replace("_", " ")}` : "";
+        const name2 = constraint2.name || `fk_${constraint2.table}_${constraint2.column}`;
+        const onDelete = constraint2.onDelete ? ` ON DELETE ${constraint2.onDelete.toUpperCase().replace("_", " ")}` : "";
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} FOREIGN KEY (${q2(constraint.column)}) REFERENCES ${q2(constraint.references.table)}(${q2(constraint.references.column)})${onDelete};`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} FOREIGN KEY (${q2(constraint2.column)}) REFERENCES ${q2(constraint2.references.table)}(${q2(constraint2.references.column)})${onDelete};`,
           warnings
         };
       }
       case "unique": {
-        const name2 = constraint.name || `uq_${constraint.table}_${constraint.columns.join("_")}`;
-        const cols = constraint.columns.map(q2).join(", ");
+        const name2 = constraint2.name || `uq_${constraint2.table}_${constraint2.columns.join("_")}`;
+        const cols = constraint2.columns.map(q2).join(", ");
         return {
           sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} UNIQUE (${cols});`,
           warnings
         };
       }
       case "check": {
-        const name2 = constraint.name || `ck_${constraint.table}`;
+        const name2 = constraint2.name || `ck_${constraint2.table}`;
         return {
-          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} CHECK (${constraint.expression});`,
+          sql: `ALTER TABLE ${t2} ADD CONSTRAINT ${q2(name2)} CHECK (${constraint2.expression});`,
           warnings: ["CHECK constraints enforced in MySQL 8.0.16+ and MariaDB 10.2.1+ only"]
         };
       }