@carllee1983/dbcli 3.0.0 → 6.0.0

package/dist/core.d.ts

@@ -255,123 +255,12 @@ export interface DatabaseAdapter {
 	 */
 	getServerVersion(): Promise<string>;
 }
-interface QueryableAdapter {
-	/**
-	 * Establish connection and verify credentials
-	 * Throws ConnectionError with categorized error type on failure
-	 * @throws {ConnectionError} If connection fails (server down, auth failed, timeout, etc.)
-	 */
-	connect(): Promise<void>;
-	/**
-	 * Close connection and release resources
-	 * Should never throw; safe to call multiple times
-	 * Handles cleanup gracefully even if already disconnected
-	 */
-	disconnect(): Promise<void>;
-	/**
-	 * Execute arbitrary query with parameterized values
-	 * Accepts JSON query strings for MongoDB operations
-	 * @param query Query string (JSON format for MongoDB)
-	 * @param params Array of parameter values in order
-	 * @param options Optional execution controls (e.g. result-cardinality limit)
-	 * @returns Execution result containing rows and metadata
-	 * @throws {ConnectionError} If query execution fails
-	 */
-	execute<T>(query: string, params?: unknown[], options?: {
-		limit?: number;
-		noLimit?: boolean;
-		projection?: Record<string, 0 | 1>;
-	}): Promise<ExecutionResult<T>>;
-	/**
-	 * List all collections in the connected database
-	 * Includes metadata such as document count
-	 * @param options Optional filter for system indices
-	 * @returns Array of collection info with basic information
-	 * @throws {ConnectionError} If query fails
-	 */
-	listCollections(options?: {
-		includeSystem?: boolean;
-		/** Redis: 取樣上限。列 key 沒有 catalog 可查，只能掃，所以上限是必要的。 */
-		limit?: number;
-	}): Promise<{
-		name: string;
-		documentCount?: number;
-	}[]>;
-	/**
-	 * Redis-only: 取樣 key 名稱並回報是否觸及取樣上限。
-	 *
-	 * 宣告在介面上而不是讓呼叫端 double-cast：`dbcli list` 與 shell 補全都需要
-	 * `truncated` 才能誠實顯示「只看了前 N 個」，而那個資訊 listCollections
-	 * 的形狀裝不下。其他引擎有 catalog 可查，不需要取樣。
-	 */
-	sampleKeyNames?(limit: number): Promise<{
-		names: string[];
-		truncated: boolean;
-	}>;
-	/**
-	 * SQL-compatible collection listing for shared command surfaces.
-	 * @param options Optional filter for system indices
-	 */
-	listTables?(options?: {
-		includeSystem?: boolean;
-	}): Promise<TableSchema[]>;
-	/**
-	 * SQL-compatible schema lookup for shared command surfaces.
-	 * @param tableName Name of collection/table to inspect
-	 * @param options Optional adapter-specific knobs (e.g. mongo `sampleSize`).
-	 */
-	getTableSchema?(tableName: string, options?: {
-		sampleSize?: number;
-		sampleMethod?: "random" | "natural";
-	}): Promise<TableSchema>;
-	/**
-	 * Test connection with lightweight probe query
-	 * Executes a ping or equivalent to verify connection is alive
-	 * @returns true if connection successful
-	 * @throws {ConnectionError} If connection test fails
-	 */
-	testConnection(): Promise<boolean>;
-	/**
-	 * Get the database server version string
-	 * @returns Raw version string from the server
-	 * @throws {ConnectionError} If not connected or query fails
-	 */
-	getServerVersion(): Promise<string>;
-	/**
-	 * Insert a single document/row
-	 * @param collection Collection or table name
-	 * @param data Data object to insert
-	 * @returns Execution result
-	 */
-	insert(collection: string, data: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
-	/**
-	 * Update documents/rows matching filter
-	 * @param collection Collection or table name
-	 * @param filter Filter object
-	 * @param update Update operations (e.g. {$set: ...})
-	 * @returns Execution result
-	 */
-	update(collection: string, filter: Record<string, unknown>, update: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
-	/**
-	 * Delete documents/rows matching filter
-	 * @param collection Collection or table name
-	 * @param filter Filter object
-	 * @returns Execution result
-	 */
-	delete(collection: string, filter: Record<string, unknown>): Promise<ExecutionResult<unknown>>;
-}
 interface BlacklistConfig {
 	/** Table names to block all operations on */
 	tables: string[];
 	/** Column names to omit per table: { tableName: [col1, col2] } */
 	columns: Record<string, string[]>;
 }
-interface RedisMaskRule {
-	/** Redis-native glob (e.g. "user:*"). */
-	keyPattern: string;
-	/** Hash field names to mask. Absent/empty → mask the whole value. */
-	fields?: string[];
-}
 interface BlacklistState {
 	/** Set of lowercase table names for O(1) case-insensitive lookup */
 	tables: Set<string>;
@@ -386,21 +275,6 @@ export declare class BlacklistError extends Error {
 	readonly operation: string;
 	constructor(message: string, tableName: string, operation: string);
 }
-/**
- * Factory for creating database adapters
- * Implements factory pattern to route to correct adapter based on system type
- * Enables system-aware instantiation without coupling CLI commands to specific drivers
- */
-export declare class AdapterFactory {
-	static createSqlAdapter(rawOptions: SqlConnectionOptions): DatabaseAdapter;
-	static createQueryableAdapter(rawOptions: QueryableConnectionOptions): QueryableAdapter;
-	static createAdapter(options: SqlConnectionOptions): DatabaseAdapter;
-	static createAdapter(options: QueryableConnectionOptions): QueryableAdapter;
-	static createAdapter(options: ConnectionOptions): DatabaseAdapter | QueryableAdapter;
-	static createMongoDBAdapter(options: ConnectionOptions): QueryableAdapter;
-	static createRedisAdapter(rawOptions: ConnectionOptions, blacklistRules?: string[], maskRules?: RedisMaskRule[]): QueryableAdapter;
-	static createElasticsearchAdapter(options: ConnectionOptions): QueryableAdapter;
-}
 /**
  * Type definitions for data modification operations
  * Defines results and options for data modification (INSERT, UPDATE, DELETE) operations
@@ -666,10 +540,6 @@ declare const SQL_DIALECTS: readonly [
 	"mariadb"
 ];
 type SqlDialect = (typeof SQL_DIALECTS)[number];
-/**
- * Manager class for loading and querying blacklist rules.
- * Instantiate once per CLI invocation.
- */
 export declare class BlacklistManager {
 	private config;
 	private state;
@@ -677,28 +547,49 @@ export declare class BlacklistManager {
 	constructor(config: DbcliConfig, overrideEnvValue?: string);
 	/**
 	 * Deserialize config.blacklist JSON into efficient Set/Map structures.
-	 * Case-insensitive table names (stored as lowercase).
-	 * Case-sensitive column names.
+	 * Case-insensitive table names (stored as lowercase). Column entries are
+	 * stored as written and folded where they are compared — see ADR-0018.
 	 *
 	 * @returns BlacklistState with Set<string> for tables, Map<string, Set<string>> for columns
 	 */
 	loadBlacklist(): BlacklistState;
 	/**
 	 * Check if a table is blacklisted.
-	 * Case-insensitive comparison.
+	 *
+	 * Case-insensitive, and each entry is a glob: `secrets*` covers
+	 * `secrets_2026`. The same array is already a glob for Redis keys and
+	 * Elasticsearch index expressions, and one config file gets one answer
+	 * (ADR-0019 Decision 4). `report\*` escapes back to a literal name.
 	 *
 	 * @param tableName Table name to check
 	 * @returns true if the table is blacklisted
 	 */
 	isTableBlacklisted(tableName: string): boolean;
+	/**
+	 * Table entries carrying glob metacharacters.
+	 *
+	 * Computed with `state` rather than lazily: `getState()` hands the same `Set`
+	 * out, and a lazy cache filled after someone added to it would leave `Set.has`
+	 * seeing the new entry and the glob scan not — fail-open, and silently.
+	 * Nothing mutates it today; the point is that nothing can start to.
+	 */
+	private readonly wildcardTables;
 	/**
 	 * Check if a specific column in a table is blacklisted.
-	 * Table name is case-insensitive; column name is case-sensitive.
+	 * Both are case-insensitive on their first segment. A column entry's later
+	 * segments are nested object keys and keep their case (ADR-0018).
 	 *
 	 * @param tableName Table name
 	 * @param columnName Column name
 	 * @returns true if the column is blacklisted
 	 */
+	/**
+	 * The rules for a table, found by the reference as written and by its last
+	 * segment. `extractTableReferences` keeps a qualified name whole, so a rule
+	 * under `public.users` did not apply to `SELECT * FROM users` and the reverse
+	 * was equally true. ADR-0018 Decision 3.
+	 */
+	private columnRulesFor;
 	isColumnBlacklisted(tableName: string, columnName: string): boolean;
 	/**
 	 * Get all blacklisted column names for a specific table.
@@ -1340,18 +1231,47 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		schemaLastUpdated?: string | undefined;
 		schemaTableCount?: number | undefined;
 	}>>>;
-	blacklist: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+	blacklist: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodObject<{
 		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
-	}, "strip", z.ZodTypeAny, {
-		columns: Record<string, string[]>;
+	}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>, {
 		tables: string[];
-	}, {
-		columns?: Record<string, string[]> | undefined;
-		tables?: string[] | undefined;
-	}>>>;
-	audit: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		columns: Record<string, string[]>;
+	}, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>>>;
+	audit: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodObject<{
 		enabled: z.ZodDefault<z.ZodBoolean>;
+		/**
+		 * 稽核寫不出來就不要動資料庫。
+		 *
+		 * audit 一直是 best-effort：磁碟滿、目錄不可寫、lock budget 耗盡時，操作
+		 * 照樣執行而紀錄不存在，只有一行 stderr 警告（一個 process 只印一次，
+		 * 管線模式通常看不到）。對多數使用者這是對的取捨——遺失一列紀錄不該讓
+		 * 工具停擺。但把稽核當成控制本身的人（ES shell 的 permission 就是這種
+		 * 情形）需要能表達相反的取捨，而先前連表達都表達不了。
+		 *
+		 * 強制點是「效果發生前」的稽核寫入（`writeAuditEntryBeforeEffect`）：
+		 * ES shell 送出請求前的那一列，與 SQL 的 gate decision。效果已經發生之後
+		 * 才寫的紀錄不在範圍內——那時拒絕擋不回任何東西，只會把一次成功的操作
+		 * 回報成失敗。
+		 *
+		 * 預設關閉：這改的是既有行為，開啟與否是使用者的判斷。
+		 */
+		strict: z.ZodDefault<z.ZodBoolean>;
 		rotation: z.ZodDefault<z.ZodOptional<z.ZodObject<{
 			max_bytes: z.ZodDefault<z.ZodNumber>;
 			max_entries: z.ZodDefault<z.ZodNumber>;
@@ -1363,12 +1283,28 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			max_entries?: number | undefined;
 		}>>>;
 	}, "strip", z.ZodTypeAny, {
+		strict: boolean;
 		enabled: boolean;
 		rotation: {
 			max_bytes: number;
 			max_entries: number;
 		};
 	}, {
+		strict?: boolean | undefined;
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	}>, {
+		strict: boolean;
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	}, {
+		strict?: boolean | undefined;
 		enabled?: boolean | undefined;
 		rotation?: {
 			max_bytes?: number | undefined;
@@ -1400,10 +1336,11 @@ declare const DbcliConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
 	schema: Record<string, any>;
 	blacklist: {
-		columns: Record<string, string[]>;
 		tables: string[];
+		columns: Record<string, string[]>;
 	};
 	audit: {
+		strict: boolean;
 		enabled: boolean;
 		rotation: {
 			max_bytes: number;
@@ -1627,11 +1564,12 @@ declare const DbcliConfigSchema: z.ZodObject<{
 		}[] | undefined;
 	} | undefined;
 	schema?: Record<string, any> | undefined;
-	blacklist?: {
-		columns?: Record<string, string[]> | undefined;
-		tables?: string[] | undefined;
-	} | undefined;
+	blacklist?: z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough"> | undefined;
 	audit?: {
+		strict?: boolean | undefined;
 		enabled?: boolean | undefined;
 		rotation?: {
 			max_bytes?: number | undefined;
@@ -1653,7 +1591,7 @@ type DbcliConfig$1 = z.infer<typeof DbcliConfigSchema>;
 declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 	version: z.ZodLiteral<2>;
 	default: z.ZodString;
-	connections: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[
+	connections: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodUnion<[
 		z.ZodObject<{
 			timeout: z.ZodOptional<z.ZodNumber>;
 			statementTimeout: z.ZodOptional<z.ZodNumber>;
@@ -2191,7 +2129,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			envFile?: string | undefined;
 			environment?: string | undefined;
 		}>
-	]>>, Record<string, {
+	]>, {
 		password: string | {
 			$env: string;
 		};
@@ -2300,7 +2238,10 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
-	}>, Record<string, {
+	}, unknown>>, Record<string, {
+		password: string | {
+			$env: string;
+		};
 		system: "postgresql" | "mysql" | "mariadb";
 		host: string | {
 			$env: string;
@@ -2314,31 +2255,30 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		database: string | {
 			$env: string;
 		};
-		password?: string | {
-			$env: string;
-		} | undefined;
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
-		system: "mongodb";
-		password?: string | {
+		password: string | {
 			$env: string;
-		} | undefined;
-		host?: string | {
+		};
+		system: "mongodb";
+		host: string | {
 			$env: string;
-		} | undefined;
-		port?: number | {
+		};
+		port: number | {
 			$env: string;
-		} | undefined;
-		user?: string | {
+		};
+		user: string | {
 			$env: string;
-		} | undefined;
-		database?: string | {
+		};
+		database: string | {
 			$env: string;
-		} | undefined;
+		};
+		srv: boolean;
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		uri?: string | {
 			$env: string;
 		} | undefined;
@@ -2349,13 +2289,14 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
-		srv?: boolean | undefined;
 		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
+		password: string | {
+			$env: string;
+		};
 		system: "redis";
 		host: string | {
 			$env: string;
@@ -2363,42 +2304,39 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		port: number | {
 			$env: string;
 		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		user?: string | {
+		user: string | {
 			$env: string;
-		} | undefined;
-		database?: string | {
+		};
+		database: string | {
 			$env: string;
-		} | undefined;
+		};
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
 		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
 	} | {
-		system: "elasticsearch";
-		password?: string | {
+		password: string | {
 			$env: string;
-		} | undefined;
-		host?: string | {
+		};
+		system: "elasticsearch";
+		host: string | {
 			$env: string;
-		} | undefined;
-		port?: number | {
+		};
+		port: number | {
 			$env: string;
-		} | undefined;
-		user?: string | {
+		};
+		user: string | {
 			$env: string;
-		} | undefined;
-		database?: string | {
+		};
+		database: string | {
 			$env: string;
-		} | undefined;
-		rejectUnauthorized?: boolean | undefined;
+		};
+		rejectUnauthorized: boolean;
+		permission: "admin" | "query-only" | "read-write" | "data-admin";
+		protocol: "http" | "https";
 		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
 		statementTimeout?: number | undefined;
-		protocol?: "http" | "https" | undefined;
 		nodes?: string[] | undefined;
 		cloudId?: string | {
 			$env: string;
@@ -2409,7 +2347,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		caPath?: string | undefined;
 		envFile?: string | undefined;
 		environment?: string | undefined;
-	}>>;
+	}>, Record<string, unknown>>;
 	schema: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>>;
 	schemas: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>>;
 	metadata: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -2428,18 +2366,47 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		schemaLastUpdated?: string | undefined;
 		schemaTableCount?: number | undefined;
 	}>>>;
-	blacklist: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+	blacklist: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodObject<{
 		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
-	}, "strip", z.ZodTypeAny, {
-		columns: Record<string, string[]>;
+	}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>, {
 		tables: string[];
-	}, {
-		columns?: Record<string, string[]> | undefined;
-		tables?: string[] | undefined;
-	}>>>;
-	audit: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+		columns: Record<string, string[]>;
+	}, z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough">>>>;
+	audit: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodObject<{
 		enabled: z.ZodDefault<z.ZodBoolean>;
+		/**
+		 * 稽核寫不出來就不要動資料庫。
+		 *
+		 * audit 一直是 best-effort：磁碟滿、目錄不可寫、lock budget 耗盡時，操作
+		 * 照樣執行而紀錄不存在，只有一行 stderr 警告（一個 process 只印一次，
+		 * 管線模式通常看不到）。對多數使用者這是對的取捨——遺失一列紀錄不該讓
+		 * 工具停擺。但把稽核當成控制本身的人（ES shell 的 permission 就是這種
+		 * 情形）需要能表達相反的取捨，而先前連表達都表達不了。
+		 *
+		 * 強制點是「效果發生前」的稽核寫入（`writeAuditEntryBeforeEffect`）：
+		 * ES shell 送出請求前的那一列，與 SQL 的 gate decision。效果已經發生之後
+		 * 才寫的紀錄不在範圍內——那時拒絕擋不回任何東西，只會把一次成功的操作
+		 * 回報成失敗。
+		 *
+		 * 預設關閉：這改的是既有行為，開啟與否是使用者的判斷。
+		 */
+		strict: z.ZodDefault<z.ZodBoolean>;
 		rotation: z.ZodDefault<z.ZodOptional<z.ZodObject<{
 			max_bytes: z.ZodDefault<z.ZodNumber>;
 			max_entries: z.ZodDefault<z.ZodNumber>;
@@ -2451,12 +2418,28 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			max_entries?: number | undefined;
 		}>>>;
 	}, "strip", z.ZodTypeAny, {
+		strict: boolean;
+		enabled: boolean;
+		rotation: {
+			max_bytes: number;
+			max_entries: number;
+		};
+	}, {
+		strict?: boolean | undefined;
+		enabled?: boolean | undefined;
+		rotation?: {
+			max_bytes?: number | undefined;
+			max_entries?: number | undefined;
+		} | undefined;
+	}>, {
+		strict: boolean;
 		enabled: boolean;
 		rotation: {
 			max_bytes: number;
 			max_entries: number;
 		};
 	}, {
+		strict?: boolean | undefined;
 		enabled?: boolean | undefined;
 		rotation?: {
 			max_bytes?: number | undefined;
@@ -2488,10 +2471,11 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
 	schema: Record<string, any>;
 	blacklist: {
-		columns: Record<string, string[]>;
 		tables: string[];
+		columns: Record<string, string[]>;
 	};
 	audit: {
+		strict: boolean;
 		enabled: boolean;
 		rotation: {
 			max_bytes: number;
@@ -2626,116 +2610,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 }, {
 	version: 2;
 	default: string;
-	connections: Record<string, {
-		system: "postgresql" | "mysql" | "mariadb";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		user: string | {
-			$env: string;
-		};
-		database: string | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "mongodb";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		uri?: string | {
-			$env: string;
-		} | undefined;
-		authSource?: string | {
-			$env: string;
-		} | undefined;
-		replicaSet?: string | {
-			$env: string;
-		} | undefined;
-		tls?: boolean | undefined;
-		srv?: boolean | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "redis";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "elasticsearch";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		rejectUnauthorized?: boolean | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		protocol?: "http" | "https" | undefined;
-		nodes?: string[] | undefined;
-		cloudId?: string | {
-			$env: string;
-		} | undefined;
-		apiKey?: string | {
-			$env: string;
-		} | undefined;
-		caPath?: string | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	}>;
+	connections: Record<string, unknown>;
 	redis?: {
 		mask?: {
 			keyPattern: string;
@@ -2743,11 +2618,12 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		}[] | undefined;
 	} | undefined;
 	schema?: Record<string, any> | undefined;
-	blacklist?: {
-		columns?: Record<string, string[]> | undefined;
-		tables?: string[] | undefined;
-	} | undefined;
+	blacklist?: z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough"> | undefined;
 	audit?: {
+		strict?: boolean | undefined;
 		enabled?: boolean | undefined;
 		rotation?: {
 			max_bytes?: number | undefined;
@@ -2764,10 +2640,11 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 }>, {
 	schema: Record<string, any>;
 	blacklist: {
-		columns: Record<string, string[]>;
 		tables: string[];
+		columns: Record<string, string[]>;
 	};
 	audit: {
+		strict: boolean;
 		enabled: boolean;
 		rotation: {
 			max_bytes: number;
@@ -2902,116 +2779,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 }, {
 	version: 2;
 	default: string;
-	connections: Record<string, {
-		system: "postgresql" | "mysql" | "mariadb";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		user: string | {
-			$env: string;
-		};
-		database: string | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "mongodb";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		uri?: string | {
-			$env: string;
-		} | undefined;
-		authSource?: string | {
-			$env: string;
-		} | undefined;
-		replicaSet?: string | {
-			$env: string;
-		} | undefined;
-		tls?: boolean | undefined;
-		srv?: boolean | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "redis";
-		host: string | {
-			$env: string;
-		};
-		port: number | {
-			$env: string;
-		};
-		password?: string | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	} | {
-		system: "elasticsearch";
-		password?: string | {
-			$env: string;
-		} | undefined;
-		host?: string | {
-			$env: string;
-		} | undefined;
-		port?: number | {
-			$env: string;
-		} | undefined;
-		user?: string | {
-			$env: string;
-		} | undefined;
-		database?: string | {
-			$env: string;
-		} | undefined;
-		rejectUnauthorized?: boolean | undefined;
-		timeout?: number | undefined;
-		permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
-		statementTimeout?: number | undefined;
-		protocol?: "http" | "https" | undefined;
-		nodes?: string[] | undefined;
-		cloudId?: string | {
-			$env: string;
-		} | undefined;
-		apiKey?: string | {
-			$env: string;
-		} | undefined;
-		caPath?: string | undefined;
-		envFile?: string | undefined;
-		environment?: string | undefined;
-	}>;
+	connections: Record<string, unknown>;
 	redis?: {
 		mask?: {
 			keyPattern: string;
@@ -3019,11 +2787,12 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 		}[] | undefined;
 	} | undefined;
 	schema?: Record<string, any> | undefined;
-	blacklist?: {
-		columns?: Record<string, string[]> | undefined;
-		tables?: string[] | undefined;
-	} | undefined;
+	blacklist?: z.objectInputType<{
+		tables: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+		columns: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+	}, z.ZodTypeAny, "passthrough"> | undefined;
 	audit?: {
+		strict?: boolean | undefined;
 		enabled?: boolean | undefined;
 		rotation?: {
 			max_bytes?: number | undefined;