@carllee1983/dbcli 3.0.0 → 6.0.0

package/dist/core.mjs

@@ -1,35 +1,5 @@
 // @bun
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
   this[name] = __returnValue.bind(null, newValue);
@@ -46,76 +16,6 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// node_modules/picocolors/picocolors.js
-var require_picocolors = __commonJS((exports, module) => {
-  var p = process || {};
-  var argv = p.argv || [];
-  var env = p.env || {};
-  var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
-  var formatter = (open, close, replace = open) => (input) => {
-    let string = "" + input, index = string.indexOf(close, open.length);
-    return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
-  };
-  var replaceClose = (string, close, replace, index) => {
-    let result = "", cursor = 0;
-    do {
-      result += string.substring(cursor, index) + replace;
-      cursor = index + close.length;
-      index = string.indexOf(close, cursor);
-    } while (~index);
-    return result + string.substring(cursor);
-  };
-  var createColors = (enabled = isColorSupported) => {
-    let f = enabled ? formatter : () => String;
-    return {
-      isColorSupported: enabled,
-      reset: f("\x1B[0m", "\x1B[0m"),
-      bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
-      dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
-      italic: f("\x1B[3m", "\x1B[23m"),
-      underline: f("\x1B[4m", "\x1B[24m"),
-      inverse: f("\x1B[7m", "\x1B[27m"),
-      hidden: f("\x1B[8m", "\x1B[28m"),
-      strikethrough: f("\x1B[9m", "\x1B[29m"),
-      black: f("\x1B[30m", "\x1B[39m"),
-      red: f("\x1B[31m", "\x1B[39m"),
-      green: f("\x1B[32m", "\x1B[39m"),
-      yellow: f("\x1B[33m", "\x1B[39m"),
-      blue: f("\x1B[34m", "\x1B[39m"),
-      magenta: f("\x1B[35m", "\x1B[39m"),
-      cyan: f("\x1B[36m", "\x1B[39m"),
-      white: f("\x1B[37m", "\x1B[39m"),
-      gray: f("\x1B[90m", "\x1B[39m"),
-      bgBlack: f("\x1B[40m", "\x1B[49m"),
-      bgRed: f("\x1B[41m", "\x1B[49m"),
-      bgGreen: f("\x1B[42m", "\x1B[49m"),
-      bgYellow: f("\x1B[43m", "\x1B[49m"),
-      bgBlue: f("\x1B[44m", "\x1B[49m"),
-      bgMagenta: f("\x1B[45m", "\x1B[49m"),
-      bgCyan: f("\x1B[46m", "\x1B[49m"),
-      bgWhite: f("\x1B[47m", "\x1B[49m"),
-      blackBright: f("\x1B[90m", "\x1B[39m"),
-      redBright: f("\x1B[91m", "\x1B[39m"),
-      greenBright: f("\x1B[92m", "\x1B[39m"),
-      yellowBright: f("\x1B[93m", "\x1B[39m"),
-      blueBright: f("\x1B[94m", "\x1B[39m"),
-      magentaBright: f("\x1B[95m", "\x1B[39m"),
-      cyanBright: f("\x1B[96m", "\x1B[39m"),
-      whiteBright: f("\x1B[97m", "\x1B[39m"),
-      bgBlackBright: f("\x1B[100m", "\x1B[49m"),
-      bgRedBright: f("\x1B[101m", "\x1B[49m"),
-      bgGreenBright: f("\x1B[102m", "\x1B[49m"),
-      bgYellowBright: f("\x1B[103m", "\x1B[49m"),
-      bgBlueBright: f("\x1B[104m", "\x1B[49m"),
-      bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
-      bgCyanBright: f("\x1B[106m", "\x1B[49m"),
-      bgWhiteBright: f("\x1B[107m", "\x1B[49m")
-    };
-  };
-  module.exports = createColors();
-  module.exports.createColors = createColors;
-});
-
 // node_modules/lru-cache/dist/esm/node/index.min.js
 import { tracingChannel as j, channel as G } from "diagnostics_channel";
 var w, W, C, D = () => w.hasSubscribers || W.hasSubscribers, I, L, P = (u, e, t2, i) => {
@@ -1245,281 +1145,6 @@ var ENGINE_CAPABILITIES = Object.freeze({
     shell: cap("limited", "interactive", "Dedicated Kibana Dev Tools-style REPL (method/path + JSON body, blank-line submit); read-focused.")
   })
 });
-// src/adapters/error-mapper.ts
-var TRANSPORT_CODES = {
-  ECONNREFUSED: "ECONNREFUSED",
-  ETIMEDOUT: "ETIMEDOUT",
-  ESOCKETTIMEDOUT: "ETIMEDOUT",
-  ENOTFOUND: "ENOTFOUND",
-  EAI_AGAIN: "ENOTFOUND",
-  PROTOCOL_CONNECTION_LOST: "CONNECTION_LOST",
-  PROTOCOL_SEQUENCE_TIMEOUT: "ETIMEDOUT",
-  ECONNRESET: "CONNECTION_LOST",
-  EPIPE: "CONNECTION_LOST",
-  ECONNABORTED: "CONNECTION_LOST",
-  EHOSTUNREACH: "EHOSTUNREACH",
-  ENETUNREACH: "EHOSTUNREACH",
-  ENETDOWN: "EHOSTUNREACH"
-};
-var TLS_CODE_PREFIX = /^(CERT_|SELF_SIGNED_|DEPTH_ZERO_|UNABLE_TO_(?:GET|VERIFY)_|ERR_TLS_|ERR_SSL_)/;
-var MYSQL_CODES = {
-  ER_NO_SUCH_TABLE: "TABLE_NOT_FOUND",
-  ER_BAD_FIELD_ERROR: "COLUMN_NOT_FOUND",
-  ER_PARSE_ERROR: "SQL_SYNTAX_ERROR",
-  ER_ACCESS_DENIED_ERROR: "AUTH_FAILED",
-  ER_DBACCESS_DENIED_ERROR: "AUTH_FAILED",
-  ER_NOT_SUPPORTED_AUTH_MODE: "AUTH_FAILED",
-  ER_MUST_CHANGE_PASSWORD_LOGIN: "AUTH_FAILED",
-  ER_QUERY_TIMEOUT: "STATEMENT_TIMEOUT",
-  ER_STATEMENT_TIMEOUT: "STATEMENT_TIMEOUT",
-  ER_CON_COUNT_ERROR: "TOO_MANY_CONNECTIONS",
-  ER_SERVER_SHUTDOWN: "CONNECTION_LOST"
-};
-var MYSQL_ERRNOS = {
-  1045: "AUTH_FAILED",
-  1044: "AUTH_FAILED",
-  1054: "COLUMN_NOT_FOUND",
-  1064: "SQL_SYNTAX_ERROR",
-  1146: "TABLE_NOT_FOUND",
-  1251: "AUTH_FAILED",
-  1698: "AUTH_FAILED",
-  1040: "TOO_MANY_CONNECTIONS",
-  1053: "CONNECTION_LOST",
-  2006: "CONNECTION_LOST",
-  2013: "CONNECTION_LOST",
-  1969: "STATEMENT_TIMEOUT",
-  3024: "STATEMENT_TIMEOUT"
-};
-var SQLSTATES = {
-  "28000": "AUTH_FAILED",
-  "28P01": "AUTH_FAILED",
-  "42601": "SQL_SYNTAX_ERROR",
-  "42P01": "TABLE_NOT_FOUND",
-  "42703": "COLUMN_NOT_FOUND",
-  "57014": "STATEMENT_TIMEOUT",
-  "08000": "CONNECTION_LOST",
-  "08003": "CONNECTION_LOST",
-  "08006": "CONNECTION_LOST",
-  "08001": "ECONNREFUSED",
-  "08004": "CONNECTION_REJECTED",
-  "53300": "TOO_MANY_CONNECTIONS",
-  "57P01": "CONNECTION_LOST",
-  "57P02": "CONNECTION_LOST",
-  "57P03": "SERVER_NOT_READY"
-};
-var REDIS_PREFIXES = {
-  NOAUTH: "AUTH_FAILED",
-  WRONGPASS: "AUTH_FAILED"
-};
-var FALLBACK_PATTERNS = [
-  [/connection refused/i, "ECONNREFUSED"],
-  [/\bECONNREFUSED\b/, "ECONNREFUSED"],
-  [/connect(?:ion)? time(?:d )?out/i, "ETIMEDOUT"],
-  [/timeout exceeded/i, "ETIMEDOUT"],
-  [/timed out/i, "ETIMEDOUT"],
-  [/connection terminated/i, "CONNECTION_LOST"],
-  [/server closed the connection/i, "CONNECTION_LOST"],
-  [/server has gone away/i, "CONNECTION_LOST"],
-  [/lost connection to \S+ server/i, "CONNECTION_LOST"],
-  [/getaddrinfo/i, "ENOTFOUND"],
-  [/authentication failed/i, "AUTH_FAILED"],
-  [/access denied for user/i, "AUTH_FAILED"],
-  [/no pg_hba\.conf entry/i, "AUTH_FAILED"],
-  [/role\s+".*?"\s+does not exist/i, "AUTH_FAILED"],
-  [/password supplied/i, "AUTH_FAILED"]
-];
-var PG_CANCEL_BY_TIMEOUT = /statement timeout/i;
-function categorize(errCode, errno, errMsg, system) {
-  if (errCode) {
-    if (TLS_CODE_PREFIX.test(errCode))
-      return "TLS_ERROR";
-    const known = TRANSPORT_CODES[errCode] ?? MYSQL_CODES[errCode] ?? SQLSTATES[errCode] ?? REDIS_PREFIXES[errCode];
-    if (known === "STATEMENT_TIMEOUT" && errCode === "57014" && !PG_CANCEL_BY_TIMEOUT.test(errMsg)) {
-      return null;
-    }
-    if (known)
-      return known;
-  }
-  const isMysqlFamily = system === "mysql" || system === "mariadb";
-  if (isMysqlFamily && typeof errno === "number" && MYSQL_ERRNOS[errno]) {
-    return MYSQL_ERRNOS[errno];
-  }
-  const redisPrefix = errMsg.match(/^([A-Z]+)\s/)?.[1];
-  if (redisPrefix && REDIS_PREFIXES[redisPrefix])
-    return REDIS_PREFIXES[redisPrefix];
-  if (errCode || isMysqlFamily && typeof errno === "number")
-    return null;
-  for (const [pattern, category] of FALLBACK_PATTERNS) {
-    if (pattern.test(errMsg))
-      return category;
-  }
-  return null;
-}
-var SYSTEM_FACTS = {
-  postgresql: {
-    serviceCheck: "systemctl status postgresql",
-    defaultPort: "default 5432",
-    firewallRule: "allow TCP 5432",
-    client: "psql",
-    logFile: "postgresql.log"
-  },
-  mysql: {
-    serviceCheck: "systemctl status mysql",
-    defaultPort: "default 3306",
-    firewallRule: "allow TCP 3306",
-    client: "mysql",
-    logFile: "mysql.log"
-  },
-  mariadb: {
-    serviceCheck: "systemctl status mariadb",
-    defaultPort: "default 3306",
-    firewallRule: "allow TCP 3306",
-    client: "mariadb",
-    logFile: "mariadb.log"
-  },
-  redis: {
-    serviceCheck: "redis-cli ping",
-    defaultPort: "default 6379",
-    firewallRule: "allow TCP 6379",
-    client: "redis-cli",
-    logFile: "redis.log"
-  }
-};
-function serviceHints(system, options) {
-  const facts = SYSTEM_FACTS[system];
-  return [
-    `Check that the ${system} service is running: ${facts.serviceCheck}`,
-    `Verify the port is correct: ${facts.defaultPort}`,
-    `Check that ${options.host} is reachable: ping ${options.host} or telnet ${options.host} ${options.port}`
-  ];
-}
-function mapError(error, system, options) {
-  if (error instanceof ConnectionError)
-    return error;
-  const err = error;
-  const errMsg = String(err?.message || String(error));
-  const errCode = String(err?.code || "");
-  const errno = err?.errno;
-  switch (categorize(errCode, errno, errMsg, system)) {
-    case "ECONNREFUSED":
-      return new ConnectionError("ECONNREFUSED", `Cannot connect to ${options.host}:${options.port} \u2014 server is not running or not listening on this port`, serviceHints(system, options));
-    case "ETIMEDOUT":
-      return new ConnectionError("ETIMEDOUT", `Connection timed out (${options.timeout || 5000}ms) \u2014 may be blocked by a firewall or slow network`, [
-        `Check firewall rules: ${SYSTEM_FACTS[system].firewallRule}`,
-        `Increase timeout: edit .dbcli and add "timeout": 15000`,
-        `Verify network connectivity: ping ${options.host} -c 3`
-      ]);
-    case "CONNECTION_LOST":
-      return new ConnectionError("CONNECTION_LOST", `Connection to ${options.host}:${options.port} was lost mid-session \u2014 the server closed it or the network dropped`, [
-        "Re-run the command: a dropped connection is often transient",
-        `Check whether the server restarted or is cycling: ${SYSTEM_FACTS[system].logFile}`,
-        "If it happens on long-running work, look at the server idle/wait timeout"
-      ]);
-    case "SERVER_NOT_READY":
-      return new ConnectionError("SERVER_NOT_READY", `${options.host}:${options.port} is not accepting connections yet \u2014 the server is starting up or recovering`, [
-        "Retry shortly: this clears on its own once startup or recovery finishes",
-        `Watch progress in the server log: ${SYSTEM_FACTS[system].logFile}`,
-        "On a replica, this also appears while it catches up with the primary"
-      ]);
-    case "CONNECTION_REJECTED":
-      return new ConnectionError("CONNECTION_REJECTED", `${options.host}:${options.port} answered but rejected the connection attempt`, [
-        "Check the server access rules (pg_hba.conf) for this user, database, and client address",
-        "If a pooler (pgbouncer / ProxySQL) sits in front, check its own rules and limits",
-        "Check whether the connection limit for this user or database is exhausted"
-      ]);
-    case "TOO_MANY_CONNECTIONS":
-      return new ConnectionError("TOO_MANY_CONNECTIONS", `${options.host}:${options.port} refused the connection \u2014 the server has no connection slots left`, [
-        "Wait and retry: the limit is on concurrent connections, not on you",
-        system === "postgresql" ? "Inspect usage: SELECT count(*) FROM pg_stat_activity \u2014 compare against max_connections" : 'Inspect usage: SHOW STATUS LIKE "Threads_connected" \u2014 compare against max_connections',
-        "Close idle sessions, or raise max_connections if the load is legitimate"
-      ]);
-    case "EHOSTUNREACH":
-      return new ConnectionError("EHOSTUNREACH", `No route to ${options.host} \u2014 the name resolved, but the host or network is unreachable`, [
-        "Check that you are on the right network or VPN",
-        `Check routing and firewall between here and ${options.host}`,
-        `Confirm the address is the one you meant: ${options.host}:${options.port}`
-      ]);
-    case "TLS_ERROR":
-      return new ConnectionError("TLS_ERROR", `TLS handshake failed: ${errMsg}`, [
-        'Point the connection at the right CA bundle: set "caPath" in .dbcli',
-        'For a self-signed certificate in a trusted network, set "rejectUnauthorized": false',
-        `Confirm the certificate covers the host you connected to: ${options.host}`
-      ]);
-    case "ENOTFOUND":
-      return new ConnectionError("ENOTFOUND", `Host not found: ${options.host}`, [
-        `Check the hostname spelling: ${options.host}`,
-        `Verify DNS resolution: nslookup ${options.host}`,
-        `If using localhost, try 127.0.0.1 (IPv4 vs IPv6 issue)`
-      ]);
-    case "AUTH_FAILED":
-      return new ConnectionError("AUTH_FAILED", `Authentication failed \u2014 check your username or password`, [
-        `Verify credentials: ${SYSTEM_FACTS[system].client} ${system === "postgresql" ? "-U" : "-u"} ${options.user} -h ${options.host}`,
-        `Check pg_hba.conf (PostgreSQL) or user privileges (MySQL)`,
-        `Re-run dbcli init to update credentials`
-      ]);
-    case "TABLE_NOT_FOUND": {
-      const mysqlMatch = errMsg.match(/Table\s+'(?:[^.']+\.)?([^']+)'/i);
-      const pgMatch = errMsg.match(/relation\s+"([^"]+)"/i);
-      const tableName = mysqlMatch?.[1] || pgMatch?.[1] || "unknown";
-      return new ConnectionError("TABLE_NOT_FOUND", `Table '${tableName}' not found in database '${options.database || "unknown"}'`, [
-        "Run `dbcli list` to see available tables",
-        "Run `dbcli schema <table>` to confirm the exact name (ORM export names may differ from DB table names)"
-      ]);
-    }
-    case "COLUMN_NOT_FOUND": {
-      const mysqlMatch = errMsg.match(/Unknown column\s+'([^']+)'/i);
-      const pgMatch = errMsg.match(/column\s+"([^"]+)"\s+does not exist/i);
-      const columnName = mysqlMatch?.[1] || pgMatch?.[1] || "unknown";
-      return new ConnectionError("COLUMN_NOT_FOUND", `Column '${columnName}' not found`, [
-        "Run `dbcli schema <table>` to see the actual column names",
-        "Column names are case-sensitive on some databases (PostgreSQL with quoted identifiers)"
-      ]);
-    }
-    case "STATEMENT_TIMEOUT": {
-      const limitMs = options.statementTimeout ?? options.timeout;
-      return new ConnectionError("STATEMENT_TIMEOUT", `Statement timed out${limitMs ? ` (${limitMs}ms)` : ""} \u2014 the server canceled this query before it finished`, [
-        'Inspect the query plan: dbcli explain "<sql>"',
-        "Raise the ceiling for this run: dbcli --statement-timeout <ms> \u2026 (0 removes it)",
-        "Narrow the query: add WHERE filters, reduce the LIMIT, or index the scanned columns"
-      ], limitMs);
-    }
-    case "SQL_SYNTAX_ERROR":
-      return new ConnectionError("SQL_SYNTAX_ERROR", `SQL syntax error: ${errMsg}`, [
-        "Check your SQL syntax near the position reported above",
-        "In query-only mode, dbcli auto-appends LIMIT 1000; use --no-limit to disable",
-        "For SHOW/DESCRIBE/EXPLAIN statements, LIMIT is not allowed \u2014 these are not auto-limited"
-      ]);
-  }
-  const reportedCode = errCode || (typeof errno === "number" ? String(errno) : "");
-  if (reportedCode) {
-    return new ConnectionError("UNKNOWN", `Database error (${reportedCode}): ${errMsg}`, [
-      "Run `dbcli schema <table>` to confirm the objects referenced by this statement",
-      `Look up ${reportedCode} in the ${system} error reference for the exact cause`
-    ]);
-  }
-  return new ConnectionError("UNKNOWN", `Connection failed: ${errMsg}`, [
-    `Check connection parameters: host=${options.host}, port=${options.port}, user=${options.user}`,
-    `View server logs: ${SYSTEM_FACTS[system].logFile}`,
-    `Try connecting directly with the ${SYSTEM_FACTS[system].client} command-line tool`
-  ]);
-}
-
-// src/adapters/sql-adapter-utils.ts
-function requireConnected(connection) {
-  if (!connection) {
-    throw new ConnectionError("UNKNOWN", "Database connection not established", [
-      "Call connect() to establish a connection"
-    ]);
-  }
-  return connection;
-}
-async function withMappedConnectionError(system, options, operation) {
-  try {
-    return await operation();
-  } catch (error) {
-    throw mapError(error, system, options);
-  }
-}
 // resources/lang/en/messages.json
 var messages_default = {
   init: {
@@ -1782,7 +1407,8 @@ Reference: {referencePath}`,
     table_added: "\u2713 Table '{table}' added to blacklist",
     table_removed: "\u2713 Table '{table}' removed from blacklist",
     column_added: "\u2713 Column '{table}.{column}' added to blacklist",
-    column_removed: "\u2713 Column '{table}.{column}' removed from blacklist"
+    column_removed: "\u2713 Column '{table}.{column}' removed from blacklist",
+    refuse_wildcard: "Refused: '{table}' contains wildcard characters, which are matched literally on {system} \u2014 the entry would never match anything. Write the exact name."
   },
   security: {
     columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
@@ -2095,7 +1721,8 @@ var messages_default2 = {
     table_added: "\u2713 \u8868\u683C '{table}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
     table_removed: "\u2713 \u8868\u683C '{table}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
     column_added: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u65B0\u589E\u81F3\u9ED1\u540D\u55AE",
-    column_removed: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664"
+    column_removed: "\u2713 \u6B04\u4F4D '{table}.{column}' \u5DF2\u5F9E\u9ED1\u540D\u55AE\u79FB\u9664",
+    refuse_wildcard: "\u5DF2\u62D2\u7D55\uFF1A'{table}' \u542B\u6709\u842C\u7528\u5B57\u5143\uFF0C\u800C {system} \u4E0A\u7684\u6BD4\u5C0D\u662F\u9010\u5B57\u9032\u884C\u7684\u2014\u2014\u9019\u7B46\u8A2D\u5B9A\u6C38\u9060\u4E0D\u6703\u547D\u4E2D\u4EFB\u4F55\u6771\u897F\u3002\u8ACB\u5BEB\u51FA\u78BA\u5207\u7684\u540D\u7A31\u3002"
   },
   security: {
     columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
@@ -2167,7 +1794,27 @@ var shell_default = {
   timing_display: "Time: {ms}ms",
   rows_display: "{count} row(s)",
   unknown_command: "Unknown command: '{command}'. Type '.help' for available commands.",
-  subcommand_prefix_hint: "This line is being read as SQL and is waiting for its `;`. If you meant the dbcli subcommand, type {command} instead. Ctrl-C cancels."
+  subcommand_prefix_hint: "This line is being read as SQL and is waiting for its `;`. If you meant the dbcli subcommand, type {command} instead. Ctrl-C cancels.",
+  es: {
+    parse_empty: "Empty request",
+    parse_needs_method_path: 'Request requires a method and a path, e.g. "GET /index/_search"',
+    parse_needs_path: "Request requires a path",
+    refuse_dot_segment: "Refused: '{path}' contains a '..' segment once decoded, and dbcli cannot tell which path Elasticsearch would route it to. Write the path out without '..'.",
+    refuse_unparseable: "Refused: '{path}' is not the request the server would receive. It cannot be parsed as a path.",
+    refuse_not_canonical: "Refused: '{path}' is not the request the server would receive. Write it as '{canonical}'.",
+    refuse_source_param: "Refused: `source` in the query string is a request body by another route. Write the body as JSON.",
+    refuse_search_template: "Refused: '{path}' is a search template, whose body cannot be inspected \u2014 it is a string rendered on the cluster, or stored there. Write the query out in full.",
+    refuse_string_body: "Refused: a quoted string request body is not supported. Write the body as JSON.",
+    refuse_audit_strict: "Refused: the audit entry for this request could not be written, and audit.strict is on. Fix the audit sink (disk space, directory permissions, a stale lockfile in .dbcli/audit) or turn audit.strict off to accept unrecorded requests.",
+    blacklist_index: "index '{index}' is blacklist-protected",
+    blacklist_unscoped: "'{path}' names no index, so it cannot be checked against the blacklist. Scope the request to an index, e.g. GET /<index>/_search.",
+    blacklist_field: "field '{field}' is blacklist-protected and cannot be named in a request \u2014 sorting, aggregating or scripting on it would return its values.",
+    banner_title: "Elasticsearch shell \u2014 Kibana Dev Tools syntax",
+    banner_hint: 'Enter "<METHOD> /<path>" then an optional JSON body; submit with a blank line. Try: GET /_cat/indices',
+    banner_keys: 'Ctrl+C cancels the current block; Ctrl+D or "exit" quits.',
+    block_cancelled: "(block cancelled)",
+    goodbye: "Goodbye"
+  }
 };
 // resources/lang/zh-TW/shell.json
 var shell_default2 = {
@@ -2190,7 +1837,27 @@ var shell_default2 = {
   timing_display: "\u8017\u6642\uFF1A{ms}ms",
   rows_display: "{count} \u7B46\u8CC7\u6599",
   unknown_command: "\u672A\u77E5\u6307\u4EE4\uFF1A'{command}'\u3002\u8F38\u5165 '.help' \u67E5\u770B\u53EF\u7528\u6307\u4EE4\u3002",
-  subcommand_prefix_hint: "\u9019\u4E00\u884C\u88AB\u7576\u6210 SQL\uFF0C\u6B63\u5728\u7B49\u5206\u865F\u3002\u5982\u679C\u4F60\u8981\u7684\u662F dbcli \u5B50\u6307\u4EE4\uFF0C\u8ACB\u6539\u6253 {command}\u3002Ctrl-C \u53EF\u53D6\u6D88\u3002"
+  subcommand_prefix_hint: "\u9019\u4E00\u884C\u88AB\u7576\u6210 SQL\uFF0C\u6B63\u5728\u7B49\u5206\u865F\u3002\u5982\u679C\u4F60\u8981\u7684\u662F dbcli \u5B50\u6307\u4EE4\uFF0C\u8ACB\u6539\u6253 {command}\u3002Ctrl-C \u53EF\u53D6\u6D88\u3002",
+  es: {
+    parse_empty: "\u7A7A\u7684\u8ACB\u6C42",
+    parse_needs_method_path: '\u8ACB\u6C42\u9700\u8981\u4E00\u500B method \u8207\u4E00\u500B path\uFF0C\u4F8B\u5982 "GET /index/_search"',
+    parse_needs_path: "\u8ACB\u6C42\u9700\u8981\u4E00\u500B path",
+    refuse_dot_segment: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u89E3\u78BC\u5F8C\u542B\u6709 '..' \u5340\u6BB5\uFF0Cdbcli \u7121\u6CD5\u5224\u65B7 Elasticsearch \u6703\u628A\u5B83\u8DEF\u7531\u5230\u54EA\u500B\u8DEF\u5F91\u3002\u8ACB\u628A\u8DEF\u5F91\u5BEB\u6210\u4E0D\u542B '..' \u7684\u5F62\u5F0F\u3002",
+    refuse_unparseable: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u5B83\u7121\u6CD5\u88AB\u89E3\u6790\u6210\u4E00\u500B\u8DEF\u5F91\u3002",
+    refuse_not_canonical: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u4E0D\u662F\u4F3A\u670D\u5668\u6703\u6536\u5230\u7684\u90A3\u500B\u8ACB\u6C42\u3002\u8ACB\u5BEB\u6210 '{canonical}'\u3002",
+    refuse_source_param: "\u5DF2\u62D2\u7D55\uFF1Aquery string \u88E1\u7684 `source` \u662F\u53E6\u4E00\u689D\u8DEF\u5F91\u4E0A\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
+    refuse_search_template: "\u5DF2\u62D2\u7D55\uFF1A'{path}' \u662F search template\uFF0C\u5B83\u7684 body \u7121\u6CD5\u6AA2\u67E5\u2014\u2014\u90A3\u662F\u4E00\u500B\u5728\u53E2\u96C6\u4E0A\u7B97\u51FA\u4F86\u7684\u5B57\u4E32\uFF0C\u6216\u8005\u6839\u672C\u5B58\u5728\u53E2\u96C6\u88E1\u3002\u8ACB\u628A\u67E5\u8A62\u5B8C\u6574\u5BEB\u51FA\u4F86\u3002",
+    refuse_string_body: "\u5DF2\u62D2\u7D55\uFF1A\u4E0D\u652F\u63F4\u4EE5\u5F15\u865F\u5B57\u4E32\u5F62\u5F0F\u5BEB\u7684 request body\u3002\u8ACB\u628A body \u5BEB\u6210 JSON\u3002",
+    refuse_audit_strict: "\u5DF2\u62D2\u7D55\uFF1A\u9019\u500B\u8ACB\u6C42\u7684\u7A3D\u6838\u7D00\u9304\u5BEB\u4E0D\u51FA\u53BB\uFF0C\u800C audit.strict \u662F\u958B\u7684\u3002\u8ACB\u4FEE\u597D\u7A3D\u6838\u8F38\u51FA\u7AEF\uFF08\u78C1\u789F\u7A7A\u9593\u3001\u76EE\u9304\u6B0A\u9650\u3001.dbcli/audit \u88E1\u6B98\u7559\u7684 lockfile\uFF09\uFF0C\u6216\u95DC\u6389 audit.strict \u4EE5\u63A5\u53D7\u6C92\u6709\u7D00\u9304\u7684\u8ACB\u6C42\u3002",
+    blacklist_index: "\u7D22\u5F15 '{index}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77",
+    blacklist_unscoped: "'{path}' \u6307\u4E0D\u51FA\u4EFB\u4F55\u7D22\u5F15\uFF0C\u56E0\u6B64\u7121\u6CD5\u5C0D\u7167\u9ED1\u540D\u55AE\u6AA2\u67E5\u3002\u8ACB\u628A\u8ACB\u6C42\u9650\u5B9A\u5230\u67D0\u500B\u7D22\u5F15\uFF0C\u4F8B\u5982 GET /<index>/_search\u3002",
+    blacklist_field: "\u6B04\u4F4D '{field}' \u53D7\u9ED1\u540D\u55AE\u4FDD\u8B77\uFF0C\u4E0D\u80FD\u51FA\u73FE\u5728\u8ACB\u6C42\u88E1\u2014\u2014\u5C0D\u5B83\u6392\u5E8F\u3001\u805A\u5408\u6216\u8DD1 script \u90FD\u6703\u628A\u5B83\u7684\u503C\u53D6\u56DE\u4F86\u3002",
+    banner_title: "Elasticsearch shell \u2014\u2014 Kibana Dev Tools \u8A9E\u6CD5",
+    banner_hint: '\u8F38\u5165 "<METHOD> /<path>"\uFF0C\u63A5\u8457\u5BEB\u53EF\u9078\u7684 JSON body\uFF1B\u7A7A\u4E00\u884C\u9001\u51FA\u3002\u53EF\u4EE5\u5148\u8A66\uFF1AGET /_cat/indices',
+    banner_keys: 'Ctrl+C \u53D6\u6D88\u76EE\u524D\u9019\u500B block\uFF1BCtrl+D \u6216 "exit" \u96E2\u958B\u3002',
+    block_cancelled: "\uFF08block \u5DF2\u53D6\u6D88\uFF09",
+    goodbye: "\u518D\u898B"
+  }
 };
 // resources/lang/en/ceremony.json
 var ceremony_default = {
@@ -2344,2585 +2011,686 @@ class MessageLoader {
     }
     return key;
   }
+  setLanguage(lang) {
+    this.currentLang = lang;
+    this.messages = {};
+    this.loadMessages();
+  }
   interpolate(key, vars) {
-    let message = this.t(key);
-    for (const [varName, value] of Object.entries(vars)) {
-      const escapedVarName = varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const regex = new RegExp(`{${escapedVarName}}`, "g");
-      message = message.replace(regex, String(value));
-    }
-    return message;
+    return this.t(key).replace(/\{([^{}]+)\}/g, (match, name) => Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : match);
   }
 }
 var messageLoader = MessageLoader.getInstance();
 var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
-// src/utils/colors.ts
-var import_picocolors = __toESM(require_picocolors(), 1);
-var colors = {
-  success: (text) => import_picocolors.default.green(text),
-  error: (text) => import_picocolors.default.red(text),
-  warn: (text) => import_picocolors.default.yellow(text),
-  info: (text) => import_picocolors.default.blue(text),
-  dim: (text) => import_picocolors.default.dim(text),
-  bold: (text) => import_picocolors.default.bold(text),
-  keyword: (text) => import_picocolors.default.blue(import_picocolors.default.bold(text))
-};
-
-// src/utils/db-version-check.ts
-var MIN_SUPPORTED_VERSIONS = {
-  postgresql: "12.0",
-  mysql: "8.0",
-  mariadb: "10.5",
-  elasticsearch: "7.10"
-};
-function parseVersionSegments(version) {
-  const match = version.match(/^(\d+(?:\.\d+)*)/);
-  if (!match)
-    return [];
-  return (match[1] ?? "").split(".").map(Number);
-}
-function isMariaDBVersion(versionString) {
-  return /mariadb/i.test(versionString);
-}
-function extractMariaDBVersion(versionString) {
-  const match = versionString.match(/(\d+\.\d+\.\d+)-MariaDB/i);
-  if (match)
-    return match[1] ?? versionString;
-  const prefixMatch = versionString.match(/^5\.5\.5-(\d+\.\d+\.\d+)/);
-  if (prefixMatch)
-    return prefixMatch[1] ?? versionString;
-  return versionString;
-}
-function compareVersions(a, b) {
-  const segA = parseVersionSegments(a);
-  const segB = parseVersionSegments(b);
-  const len = Math.max(segA.length, segB.length);
-  for (let i = 0;i < len; i++) {
-    const diff = (segA[i] ?? 0) - (segB[i] ?? 0);
-    if (diff !== 0)
-      return diff;
-  }
-  return 0;
-}
-function checkDbVersion(rawVersion, declaredSystem) {
-  const isMariaDB = isMariaDBVersion(rawVersion);
-  const system = isMariaDB ? "mariadb" : declaredSystem;
-  const serverVersion = isMariaDB ? extractMariaDBVersion(rawVersion) : rawVersion;
-  const minVersion = MIN_SUPPORTED_VERSIONS[system];
-  const supported = compareVersions(serverVersion, minVersion ?? "0") >= 0;
-  return {
-    serverVersion,
-    system,
-    supported,
-    minVersion: minVersion ?? "0"
-  };
-}
-function warnIfUnsupported(result) {
-  if (result.supported)
-    return;
-  const message = t_vars("version.unsupported_warning", {
-    system: result.system,
-    version: result.serverVersion,
-    minVersion: result.minVersion
-  });
-  process.stderr.write(colors.warn(`\u26A0 ${message}`) + `
-`);
-}
-
-// src/utils/encoding.ts
-var CP1252_REVERSE = {
-  8364: 128,
-  8218: 130,
-  402: 131,
-  8222: 132,
-  8230: 133,
-  8224: 134,
-  8225: 135,
-  710: 136,
-  8240: 137,
-  352: 138,
-  8249: 139,
-  338: 140,
-  381: 142,
-  8216: 145,
-  8217: 146,
-  8220: 147,
-  8221: 148,
-  8226: 149,
-  8211: 150,
-  8212: 151,
-  732: 152,
-  8482: 153,
-  353: 154,
-  8250: 155,
-  339: 156,
-  382: 158,
-  376: 159
-};
-function fixDoubleEncodedUtf8(str) {
-  if (!str)
-    return str;
-  const bytes = [];
-  for (const char of str) {
-    const code = char.codePointAt(0);
-    if (code < 128) {
-      bytes.push(code);
-    } else if (code <= 255) {
-      bytes.push(code);
-    } else {
-      const cp1252Byte = CP1252_REVERSE[code];
-      if (cp1252Byte !== undefined) {
-        bytes.push(cp1252Byte);
-      } else {
-        return str;
-      }
-    }
-  }
-  try {
-    const decoded = new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(bytes));
-    if (decoded !== str) {
-      return decoded;
+// src/utils/glob.ts
+function findClassEnd(glob, open) {
+  for (let i = open + 1;i < glob.length; i++) {
+    if (glob[i] === "\\") {
+      i++;
+      continue;
     }
-  } catch {}
-  return str;
-}
-
-// src/adapters/identifier-quote.ts
-function quoteCharFor(dialect) {
-  return dialect === "postgresql" ? '"' : "`";
-}
-function assertQuotable(name, what) {
-  if (name.length === 0) {
-    throw new Error(`${what} must not be empty`);
-  }
-  if (name.includes(String.fromCharCode(0))) {
-    throw new Error(`${what} must not contain a NUL character`);
-  }
-}
-function quoteIdentifier(name, dialect) {
-  assertQuotable(name, "identifier");
-  const q = quoteCharFor(dialect);
-  return `${q}${name.split(q).join(q + q)}${q}`;
-}
-function encodeEsPathSegment(value) {
-  if (value.length === 0) {
-    throw new Error("Elasticsearch path segment must not be empty");
-  }
-  if (value === "." || value === "..") {
-    return value.replaceAll(".", "%2E");
+    if (glob[i] === "]")
+      return i;
   }
-  return encodeURIComponent(value);
+  return -1;
 }
-function encodeEsIndexExpression(expression) {
-  if (expression.length === 0) {
-    throw new Error("Elasticsearch index expression must not be empty");
+function isValidCharacterClass(body) {
+  try {
+    new RegExp(body);
+    return true;
+  } catch {
+    return false;
   }
-  return expression.split(",").map((part) => encodeEsPathSegment(part)).join(",");
 }
-
-// src/adapters/timeout-policy.ts
-var DEFAULT_CONNECT_TIMEOUT_MS = 5000;
-function resolveTimeoutPolicy(options) {
-  return {
-    connectMs: options.timeout ?? DEFAULT_CONNECT_TIMEOUT_MS,
-    statementMs: options.statementTimeout ?? options.timeout
+var parsedGlobs = new Map;
+function parseGlob(glob) {
+  const memo = parsedGlobs.get(glob);
+  if (memo !== undefined)
+    return memo;
+  const parsed = parseGlobUncached(glob);
+  parsedGlobs.set(glob, parsed);
+  return parsed;
+}
+function parseGlobUncached(glob) {
+  const runs = [];
+  let current = [];
+  let leadingStar = false;
+  let trailingStar = false;
+  let sawStar = false;
+  const endRun = () => {
+    if (current.length > 0)
+      runs.push(current);
+    current = [];
   };
-}
-function statementTimeoutSql(system, ms) {
-  if (system === "mariadb") {
-    return `SET SESSION max_statement_time = ${ms / 1000}`;
-  }
-  return `SET SESSION max_execution_time = ${Math.round(ms)}`;
-}
-
-// src/adapters/postgresql-adapter.ts
-class PostgreSQLAdapter {
-  pool = null;
-  client = null;
-  options;
-  constructor(options) {
-    this.options = options;
-    if (options.port < 1 || options.port > 65535) {
-      throw new Error(`Invalid port number: ${options.port}`);
-    }
-  }
-  async connect() {
-    await withMappedConnectionError("postgresql", this.options, async () => {
-      const timeouts = resolveTimeoutPolicy(this.options);
-      const { Pool } = await import("pg");
-      this.pool = new Pool({
-        host: this.options.host,
-        port: this.options.port,
-        user: this.options.user,
-        password: this.options.password,
-        database: this.options.database,
-        connectionTimeoutMillis: timeouts.connectMs,
-        ...timeouts.statementMs !== undefined && { statement_timeout: timeouts.statementMs }
-      });
-      await this.testConnection();
-      try {
-        const rawVersion = await this.getServerVersion();
-        const result = checkDbVersion(rawVersion, "postgresql");
-        warnIfUnsupported(result);
-      } catch {}
-    });
-  }
-  async disconnect() {
-    try {
-      if (this.client) {
-        await this.client.release();
-        this.client = null;
-      }
-      if (this.pool) {
-        await this.pool.end();
-        this.pool = null;
-      }
-    } catch {}
-  }
-  async testConnection() {
-    requireConnected(this.pool);
-    return withMappedConnectionError("postgresql", this.options, async () => {
-      const result = await this.execute("SELECT 1 as count");
-      return result.rows.length > 0;
-    });
-  }
-  async execute(sql, params) {
-    const pool = requireConnected(this.pool);
-    return withMappedConnectionError("postgresql", this.options, async () => {
-      const result = params ? await pool.query(sql, params) : await pool.query(sql);
-      return {
-        rows: result.rows,
-        affectedRows: result.rowCount ?? 0
-      };
-    });
-  }
-  async getServerVersion() {
-    const result = await this.execute("SHOW server_version");
-    return result.rows[0]?.server_version ?? "unknown";
-  }
-  async listTables() {
-    requireConnected(this.pool);
-    return withMappedConnectionError("postgresql", this.options, async () => {
-      const query = `
-        SELECT
-          n.nspname as schema_name,
-          c.relname as table_name,
-          c.reltuples::bigint as estimated_rows,
-          CASE c.relkind
-            WHEN 'r' THEN 'table'
-            WHEN 'v' THEN 'view'
-            WHEN 'm' THEN 'view'
-            ELSE 'table'
-          END as table_type,
-          (SELECT COUNT(*) FROM information_schema.columns ic
-           WHERE ic.table_schema = 'public' AND ic.table_name = c.relname)::int as column_count
-        FROM pg_class c
-        JOIN pg_namespace n ON n.oid = c.relnamespace
-        WHERE n.nspname = 'public'
-          AND c.relkind IN ('r', 'v', 'm')
-        ORDER BY c.relname
-      `;
-      const result = await this.execute(query);
-      return result.rows.map((row) => ({
-        name: row.table_name,
-        schema: row.schema_name,
-        columns: [],
-        columnCount: row.column_count,
-        rowCount: Math.max(0, row.estimated_rows || 0),
-        engine: "PostgreSQL",
-        estimatedRowCount: Math.max(0, row.estimated_rows || 0),
-        tableType: row.table_type
-      }));
-    });
-  }
-  async getTableSchema(tableName, options) {
-    requireConnected(this.pool);
-    return withMappedConnectionError("postgresql", this.options, async () => {
-      const columnQuery = `
-        SELECT
-          c.column_name as name,
-          c.data_type as type,
-          c.is_nullable = 'YES' as nullable,
-          c.column_default as default_value,
-          (
-            SELECT EXISTS(
-              SELECT 1 FROM information_schema.table_constraints tc
-              JOIN information_schema.key_column_usage kcu
-                ON tc.constraint_catalog = kcu.constraint_catalog
-                AND tc.constraint_schema = kcu.constraint_schema
-                AND tc.constraint_name = kcu.constraint_name
-              WHERE tc.table_catalog = c.table_catalog
-                AND tc.table_schema = c.table_schema
-                AND tc.table_name = c.table_name
-                AND kcu.table_catalog = c.table_catalog
-                AND kcu.table_schema = c.table_schema
-                AND kcu.table_name = c.table_name
-                AND tc.constraint_type = 'PRIMARY KEY'
-                AND kcu.column_name = c.column_name
-            )
-          ) as is_primary_key,
-          (c.column_default LIKE 'nextval%') as auto_increment,
-          pgd.description as comment
-        FROM information_schema.columns c
-        LEFT JOIN pg_catalog.pg_statio_all_tables st
-          ON st.schemaname = c.table_schema AND st.relname = c.table_name
-        LEFT JOIN pg_catalog.pg_description pgd
-          ON pgd.objoid = st.relid AND pgd.objsubid = c.ordinal_position
-        WHERE c.table_name = $1
-          AND c.table_schema = 'public'
-        ORDER BY c.ordinal_position
-      `;
-      const columnResult = await this.execute(columnQuery, [tableName]);
-      const columns = columnResult.rows;
-      const enumQuery = `
-        SELECT
-          c.column_name as name,
-          array_agg(e.enumlabel ORDER BY e.enumsortorder) as enum_values
-        FROM information_schema.columns c
-        JOIN pg_catalog.pg_type AS enum_type
-          ON enum_type.typname = c.udt_name
-        JOIN pg_catalog.pg_namespace AS enum_schema
-          ON enum_schema.oid = enum_type.typnamespace
-          AND enum_schema.nspname = c.udt_schema
-        JOIN pg_catalog.pg_enum AS e ON e.enumtypid = enum_type.oid
-        WHERE c.table_name = $1
-          AND c.table_schema = 'public'
-        GROUP BY c.column_name
-      `;
-      const enumResult = await this.execute(enumQuery, [tableName]);
-      const enumResults = enumResult.rows;
-      const enumMap = new Map;
-      for (const row of enumResults) {
-        enumMap.set(row.name, Array.isArray(row.enum_values) ? row.enum_values : []);
-      }
-      const fkQuery = `
-        SELECT
-          constraint_info.conname as name,
-          array_agg(source_column.attname ORDER BY source_key.ordinality) as columns,
-          referenced_schema.nspname as ref_schema,
-          referenced_table.relname as ref_table,
-          array_agg(referenced_column.attname ORDER BY source_key.ordinality) as ref_columns
-        FROM pg_catalog.pg_constraint AS constraint_info
-        JOIN pg_catalog.pg_class AS source_table
-          ON source_table.oid = constraint_info.conrelid
-        JOIN pg_catalog.pg_namespace AS source_schema
-          ON source_schema.oid = source_table.relnamespace
-        JOIN pg_catalog.pg_class AS referenced_table
-          ON referenced_table.oid = constraint_info.confrelid
-        JOIN pg_catalog.pg_namespace AS referenced_schema
-          ON referenced_schema.oid = referenced_table.relnamespace
-        JOIN LATERAL unnest(constraint_info.conkey) WITH ORDINALITY
-          AS source_key(attnum, ordinality) ON TRUE
-        JOIN LATERAL unnest(constraint_info.confkey) WITH ORDINALITY
-          AS referenced_key(attnum, ordinality)
-          ON referenced_key.ordinality = source_key.ordinality
-        JOIN pg_catalog.pg_attribute AS source_column
-          ON source_column.attrelid = constraint_info.conrelid
-          AND source_column.attnum = source_key.attnum
-        JOIN pg_catalog.pg_attribute AS referenced_column
-          ON referenced_column.attrelid = constraint_info.confrelid
-          AND referenced_column.attnum = referenced_key.attnum
-        WHERE constraint_info.contype = 'f'
-          AND source_table.relname = $1
-          AND source_schema.nspname = 'public'
-        GROUP BY
-          constraint_info.oid,
-          constraint_info.conname,
-          referenced_schema.nspname,
-          referenced_table.relname
-        ORDER BY constraint_info.oid
-      `;
-      const fkResult = await this.execute(fkQuery, [tableName]);
-      const fkResults = fkResult.rows;
-      const fkMap = new Map;
-      for (const fk of fkResults) {
-        if (fk.columns.length === 1 && fk.ref_columns.length === 1) {
-          fkMap.set(fk.columns[0], { table: fk.ref_table, column: fk.ref_columns[0] });
-        }
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      trailingStar = false;
+      current.push({ kind: "literal", char: glob[++i] });
+      continue;
+    }
+    if (c === "*") {
+      if (!sawStar && current.length === 0)
+        leadingStar = true;
+      sawStar = true;
+      trailingStar = true;
+      endRun();
+      continue;
+    }
+    trailingStar = false;
+    if (c === "?") {
+      current.push({ kind: "any" });
+      continue;
+    }
+    if (c === "[") {
+      const end = findClassEnd(glob, i);
+      const body = end === -1 ? "" : glob.slice(i, end + 1);
+      if (body !== "" && isValidCharacterClass(body)) {
+        current.push({ kind: "class", test: new RegExp(`^${body}$`, "s") });
+        i = end;
+        continue;
       }
-      const indexQuery = `
-        SELECT
-          i.relname as name,
-          array_agg(a.attname ORDER BY array_position(ix.indkey, a.attnum)) as columns,
-          ix.indisunique as is_unique
-        FROM pg_index ix
-        JOIN pg_class t ON t.oid = ix.indrelid
-        JOIN pg_class i ON i.oid = ix.indexrelid
-        JOIN pg_namespace n ON n.oid = t.relnamespace
-        JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = ANY(ix.indkey)
-        WHERE t.relname = $1
-          AND n.nspname = 'public'
-          AND NOT ix.indisprimary
-        GROUP BY i.relname, ix.indisunique
-      `;
-      const indexResult = await this.execute(indexQuery, [tableName]);
-      const indexResults = indexResult.rows;
-      const estimateQuery = `
-        SELECT source_table.reltuples::bigint as estimated_rows
-        FROM pg_catalog.pg_class AS source_table
-        JOIN pg_catalog.pg_namespace AS source_schema
-          ON source_schema.oid = source_table.relnamespace
-        WHERE source_table.relname = $1
-          AND source_schema.nspname = 'public'
-      `;
-      const estimateResult = await this.execute(estimateQuery, [
-        tableName
-      ]);
-      const estimateResults = estimateResult.rows;
-      const pkQuery = `
-        SELECT
-          array_agg(primary_key_column.attname ORDER BY primary_key.ordinality) as columns
-        FROM pg_catalog.pg_index AS index_info
-        JOIN pg_catalog.pg_class AS source_table
-          ON source_table.oid = index_info.indrelid
-        JOIN pg_catalog.pg_namespace AS source_schema
-          ON source_schema.oid = source_table.relnamespace
-        JOIN LATERAL unnest(index_info.indkey) WITH ORDINALITY
-          AS primary_key(attnum, ordinality) ON TRUE
-        JOIN pg_catalog.pg_attribute AS primary_key_column
-          ON primary_key_column.attrelid = source_table.oid
-          AND primary_key_column.attnum = primary_key.attnum
-        WHERE index_info.indisprimary
-          AND source_table.relname = $1
-          AND source_schema.nspname = 'public'
-      `;
-      const pkResult = await this.execute(pkQuery, [tableName]);
-      const pkResults = pkResult.rows;
-      const qualifiedTableName = `${quoteIdentifier("public", "postgresql")}.${quoteIdentifier(tableName, "postgresql")}`;
-      const exactRowCount = options?.exactRowCount === false ? undefined : (await this.execute(`SELECT COUNT(*) as count FROM ${qualifiedTableName}`)).rows[0]?.count;
-      const primaryKeyArray = Array.isArray(pkResults[0]?.columns) ? pkResults[0].columns : [];
-      const safeForeignKeys = fkResults.map((fk) => ({
-        name: fk.name,
-        columns: Array.isArray(fk.columns) ? fk.columns : [],
-        refSchema: fk.ref_schema,
-        refTable: fk.ref_table,
-        refColumns: Array.isArray(fk.ref_columns) ? fk.ref_columns : []
-      }));
-      const schema = {
-        name: tableName,
-        schema: "public",
-        columns: columns.map((col) => ({
-          name: col.name,
-          type: col.type,
-          nullable: col.nullable,
-          default: col.default_value || undefined,
-          primaryKey: col.is_primary_key,
-          foreignKey: fkMap.get(col.name),
-          autoIncrement: col.auto_increment,
-          comment: col.comment ? fixDoubleEncodedUtf8(col.comment) : null,
-          enumValues: enumMap.get(col.name)
-        })),
-        rowCount: exactRowCount ?? Math.max(0, estimateResults[0]?.estimated_rows || 0),
-        engine: "PostgreSQL",
-        primaryKey: primaryKeyArray,
-        foreignKeys: safeForeignKeys,
-        indexes: indexResults.map((idx) => ({
-          name: idx.name,
-          columns: Array.isArray(idx.columns) ? idx.columns : [],
-          unique: idx.is_unique
-        })),
-        estimatedRowCount: Math.max(0, estimateResults[0]?.estimated_rows || 0)
-      };
-      return schema;
-    });
+      current.push({ kind: "literal", char: "[" });
+      continue;
+    }
+    current.push({ kind: "literal", char: c });
   }
+  endRun();
+  return { runs, leadingStar, trailingStar, anchored: !sawStar };
 }
-
-// src/adapters/mysql-adapter.ts
-function parseEnumValues(columnType) {
-  const match = columnType.match(/^enum\((.+)\)$/i);
-  if (!match)
-    return;
-  return (match[1] ?? "").split(",").map((v) => v.trim().replace(/^'|'$/g, ""));
-}
-
-class MySQLAdapter {
-  db = null;
-  options;
-  system;
-  constructor(options) {
-    this.options = options;
-    this.system = options.system === "mariadb" ? "mariadb" : "mysql";
-    if (options.port < 1 || options.port > 65535) {
-      throw new Error(`Invalid port number: ${options.port}`);
-    }
-  }
-  async connect() {
-    await withMappedConnectionError(this.system, this.options, async () => {
-      const timeouts = resolveTimeoutPolicy(this.options);
-      const { default: driver } = await import("mysql2/promise");
-      this.db = await driver.createConnection({
-        host: this.options.host,
-        port: this.options.port,
-        user: this.options.user,
-        password: this.options.password || undefined,
-        database: this.options.database,
-        charset: "utf8mb4",
-        connectTimeout: timeouts.connectMs
-      });
-      await this.db.execute("SET NAMES utf8mb4");
-      if (timeouts.statementMs !== undefined) {
-        try {
-          await this.db.query(statementTimeoutSql(this.system, timeouts.statementMs));
-        } catch {}
-      }
-      await this.testConnection();
-      try {
-        const rawVersion = await this.getServerVersion();
-        const result = checkDbVersion(rawVersion, this.system);
-        warnIfUnsupported(result);
-      } catch {}
-    });
-  }
-  async disconnect() {
-    try {
-      if (this.db) {
-        await this.db.end();
-        this.db = null;
-      }
-    } catch {}
-  }
-  async testConnection() {
-    requireConnected(this.db);
-    return withMappedConnectionError(this.system, this.options, async () => {
-      const result = await this.execute("SELECT 1 as count");
-      return result.rows.length > 0;
-    });
+function runMatchesAt(run, text, at) {
+  if (at + run.length > text.length)
+    return false;
+  for (let i = 0;i < run.length; i++) {
+    const token = run[i];
+    const ch = text[at + i];
+    if (token.kind === "literal") {
+      if (token.char !== ch)
+        return false;
+    } else if (token.kind === "class") {
+      if (!token.test.test(ch))
+        return false;
+    }
   }
-  async execute(sql, params) {
-    const db = requireConnected(this.db);
-    return withMappedConnectionError(this.system, this.options, async () => {
-      const [result] = params ? await db.execute(sql, params) : await db.execute(sql);
-      if (Array.isArray(result)) {
-        return {
-          rows: result,
-          affectedRows: result.length
-        };
-      }
-      const header = result;
-      return {
-        rows: [],
-        affectedRows: header.affectedRows || 0,
-        lastInsertId: header.insertId
-      };
-    });
+  return true;
+}
+function globMatches(glob, text) {
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob);
+  if (anchored) {
+    const run = runs[0] ?? [];
+    return text.length === run.length && runMatchesAt(run, text, 0);
   }
-  async getServerVersion() {
-    const result = await this.execute("SELECT VERSION() as version");
-    return result.rows[0]?.version ?? "unknown";
-  }
-  async listTables() {
-    requireConnected(this.db);
-    return withMappedConnectionError(this.system, this.options, async () => {
-      const query = `
-        SELECT
-          t.TABLE_NAME as table_name,
-          t.TABLE_ROWS as row_count,
-          t.ENGINE as engine,
-          t.TABLE_TYPE as table_type,
-          COUNT(c.COLUMN_NAME) as column_count
-        FROM information_schema.TABLES t
-        LEFT JOIN information_schema.COLUMNS c
-          ON t.TABLE_SCHEMA = c.TABLE_SCHEMA AND t.TABLE_NAME = c.TABLE_NAME
-        WHERE t.TABLE_SCHEMA = DATABASE()
-        GROUP BY t.TABLE_NAME, t.TABLE_ROWS, t.ENGINE, t.TABLE_TYPE
-        ORDER BY t.TABLE_NAME
-      `;
-      const result = await this.execute(query);
-      return result.rows.map((row) => ({
-        name: row.table_name,
-        columns: [],
-        columnCount: row.column_count,
-        rowCount: row.row_count || 0,
-        engine: row.engine,
-        estimatedRowCount: row.row_count || 0,
-        tableType: row.table_type === "VIEW" ? "view" : "table"
-      }));
-    });
+  if (runs.length === 0)
+    return true;
+  let cursor = 0;
+  let first = 0;
+  let last = runs.length;
+  if (!leadingStar) {
+    const head = runs[0];
+    if (!runMatchesAt(head, text, 0))
+      return false;
+    cursor = head.length;
+    first = 1;
   }
-  async getTableSchema(tableName, options) {
-    requireConnected(this.db);
-    return withMappedConnectionError(this.system, this.options, async () => {
-      const columnQuery = `
-        SELECT
-          COLUMN_NAME as name,
-          COLUMN_TYPE as type,
-          IS_NULLABLE = 'YES' as nullable,
-          COLUMN_DEFAULT as default_value,
-          COLUMN_KEY = 'PRI' as is_primary_key,
-          EXTRA LIKE '%auto_increment%' as auto_increment,
-          COLUMN_COMMENT as comment
-        FROM information_schema.COLUMNS
-        WHERE TABLE_SCHEMA = DATABASE()
-          AND TABLE_NAME = ?
-        ORDER BY ORDINAL_POSITION
-      `;
-      const columnResult = await this.execute(columnQuery, [tableName]);
-      const columns = columnResult.rows;
-      const fkQuery = `
-        SELECT
-          rc.CONSTRAINT_NAME as name,
-          GROUP_CONCAT(kcu.COLUMN_NAME) as columns,
-          rc.REFERENCED_TABLE_NAME as ref_table,
-          GROUP_CONCAT(kcu.REFERENCED_COLUMN_NAME) as ref_columns
-        FROM information_schema.REFERENTIAL_CONSTRAINTS rc
-        JOIN information_schema.KEY_COLUMN_USAGE kcu
-          ON rc.CONSTRAINT_NAME = kcu.CONSTRAINT_NAME AND rc.TABLE_NAME = kcu.TABLE_NAME
-        WHERE kcu.TABLE_NAME = ? AND rc.CONSTRAINT_SCHEMA = DATABASE()
-        GROUP BY rc.CONSTRAINT_NAME, rc.REFERENCED_TABLE_NAME
-      `;
-      const fkResult = await this.execute(fkQuery, [tableName]);
-      const fkResults = fkResult.rows;
-      const fkMap = new Map;
-      for (const fk of fkResults) {
-        const cols = fk.columns.split(",").map((c) => c.trim());
-        const refCols = fk.ref_columns.split(",").map((c) => c.trim());
-        if (cols.length === 1 && refCols.length === 1) {
-          fkMap.set(cols[0], { table: fk.ref_table, column: refCols[0] });
-        }
+  if (!trailingStar) {
+    const tail = runs[last - 1];
+    const at = text.length - tail.length;
+    if (at < cursor || !runMatchesAt(tail, text, at))
+      return false;
+    last -= 1;
+  }
+  const limit = trailingStar ? text.length : text.length - runs[runs.length - 1].length;
+  for (let r = first;r < last; r++) {
+    const run = runs[r];
+    let found = -1;
+    for (let at = cursor;at + run.length <= limit; at++) {
+      if (runMatchesAt(run, text, at)) {
+        found = at;
+        break;
       }
-      const primaryKeyColumns = columns.filter((col) => col.is_primary_key).map((col) => col.name);
-      const indexQuery = `
-        SELECT
-          INDEX_NAME as name,
-          GROUP_CONCAT(COLUMN_NAME ORDER BY SEQ_IN_INDEX) as columns,
-          NOT NON_UNIQUE as is_unique
-        FROM information_schema.STATISTICS
-        WHERE TABLE_SCHEMA = DATABASE()
-          AND TABLE_NAME = ?
-          AND INDEX_NAME != 'PRIMARY'
-        GROUP BY INDEX_NAME, NON_UNIQUE
-      `;
-      const indexResult = await this.execute(indexQuery, [tableName]);
-      const indexResults = indexResult.rows;
-      const tableMetaQuery = `
-        SELECT ENGINE as engine, TABLE_ROWS as estimated_rows
-        FROM information_schema.TABLES
-        WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ?
-      `;
-      const tableMetaResult = await this.execute(tableMetaQuery, [tableName]);
-      const tableMeta = tableMetaResult.rows[0];
-      const estimatedRowCount = Math.max(0, tableMeta?.estimated_rows || 0);
-      const exactRowCount = options?.exactRowCount === false ? undefined : (await this.execute(`SELECT COUNT(*) as count FROM ${quoteIdentifier(tableName, this.system)}`)).rows[0]?.count;
-      const schema = {
-        name: tableName,
-        columns: columns.map((col) => ({
-          name: col.name,
-          type: col.type,
-          nullable: col.nullable,
-          default: col.default_value || undefined,
-          primaryKey: col.is_primary_key,
-          foreignKey: fkMap.get(col.name),
-          autoIncrement: col.auto_increment,
-          comment: col.comment ? fixDoubleEncodedUtf8(col.comment) : null,
-          enumValues: parseEnumValues(col.type)
-        })),
-        rowCount: exactRowCount ?? estimatedRowCount,
-        engine: tableMeta?.engine || "MySQL",
-        primaryKey: primaryKeyColumns,
-        foreignKeys: fkResults.map((fk) => ({
-          name: fk.name,
-          columns: fk.columns.split(",").map((c) => c.trim()),
-          refTable: fk.ref_table,
-          refColumns: fk.ref_columns.split(",").map((c) => c.trim())
-        })),
-        indexes: indexResults.map((idx) => ({
-          name: idx.name,
-          columns: idx.columns.split(",").map((c) => c.trim()),
-          unique: idx.is_unique
-        })),
-        estimatedRowCount
-      };
-      return schema;
-    });
-  }
-}
-
-// src/adapters/mongodb-adapter.ts
-import { resolveSrv, resolveTxt } from "dns/promises";
-
-// src/adapters/server-side-script.ts
-class ServerSideScriptRejection extends Error {
-  operator;
-  constructor(message, operator) {
-    super(message);
-    this.operator = operator;
-    this.name = "ServerSideScriptRejection";
-    Object.setPrototypeOf(this, ServerSideScriptRejection.prototype);
-  }
-}
-var MONGO_SCRIPT_OPERATORS = ["$where", "$function", "$accumulator"];
-var ES_SCRIPT_KEYS = ["script", "script_fields"];
-function findKey(value, keys) {
-  if (value === null || typeof value !== "object")
-    return;
-  if (Array.isArray(value)) {
-    for (const item of value) {
-      const found = findKey(item, keys);
-      if (found)
-        return found;
     }
-    return;
-  }
-  const record = value;
-  for (const key of keys) {
-    if (key in record)
-      return key;
-  }
-  for (const nested of Object.values(record)) {
-    const found = findKey(nested, keys);
-    if (found)
-      return found;
+    if (found === -1)
+      return false;
+    cursor = found + run.length;
   }
-  return;
+  return true;
 }
-function assertNoMongoServerSideScript(query) {
-  const operator = findKey(query, MONGO_SCRIPT_OPERATORS);
-  if (!operator)
-    return;
-  throw new ServerSideScriptRejection(`MongoDB server-side script rejected: '${operator}' executes JavaScript on the database server. ` + `Rewrite the query with standard operators, or run it through a tool that is meant to allow it.`, operator);
-}
-function assertNoElasticsearchScript(body) {
-  const key = findKey(body, ES_SCRIPT_KEYS);
-  if (!key)
-    return;
-  throw new ServerSideScriptRejection(`Elasticsearch server-side script rejected: '${key}' executes script code on the cluster. ` + `Rewrite the query without it.`, key);
-}
-
-// src/adapters/mongodb-adapter.ts
-class MongoDBAdapter {
-  options;
-  ClientClass;
-  client = null;
-  constructor(options, ClientClass = null) {
-    this.options = options;
-    this.ClientClass = ClientClass;
-  }
-  async resolveClientClass() {
-    if (this.ClientClass)
-      return this.ClientClass;
-    const { MongoClient } = await import("mongodb");
-    return MongoClient;
-  }
-  buildUri() {
-    if (this.options.uri)
-      return this.options.uri;
-    const { user, password, host, port, database, authSource, replicaSet, tls, srv } = this.options;
-    if (!host) {
-      throw new ConnectionError("UNKNOWN", "MongoDB host \u672A\u8A2D\u5B9A", [
-        "\u8ACB\u586B\u5BEB host\uFF0C\u6216\u6539\u7528 uri \u6B04\u4F4D\u6307\u5B9A\u5B8C\u6574\u9023\u7DDA\u5B57\u4E32"
-      ]);
-    }
-    const isBracketedIpv6 = /^\[[0-9a-f:]+\]$/i.test(host);
-    if (!isBracketedIpv6 && /[/@?#:\s\\]/.test(host)) {
-      throw new ConnectionError("UNKNOWN", `MongoDB host \u542B\u6709\u975E\u6CD5\u5B57\u5143: ${host}`, [
-        "host \u53EA\u61C9\u5305\u542B\u4E3B\u6A5F\u540D\u7A31\u6216 IP\uFF0C\u4E0D\u8981\u542B /\u3001@\u3001?\u3001#\u3001: \u6216\u7A7A\u767D",
-        "\u57E0\u865F\u8ACB\u586B\u5728 port \u6B04\u4F4D\uFF0C\u4E0D\u8981\u4F75\u9032 host",
-        "IPv6 \u4F4D\u5740\u8ACB\u52A0\u65B9\u62EC\u865F\uFF0C\u4F8B\u5982 [::1]",
-        "\u82E5\u8981\u6307\u5B9A\u5B8C\u6574\u9023\u7DDA\u5B57\u4E32\uFF0C\u8ACB\u6539\u7528 uri \u6B04\u4F4D"
-      ]);
-    }
-    if (user && !password) {
-      throw new ConnectionError("UNKNOWN", "\u5DF2\u6307\u5B9A user \u4F46\u672A\u63D0\u4F9B password", [
-        '\u8ACB\u88DC\u4E0A password\uFF0C\u6216\u6539\u7528\u74B0\u5883\u8B8A\u6578\u53C3\u7167 {"$env": "..."}',
-        "\u82E5\u78BA\u5B9A\u8981\u4EE5\u7121\u8A8D\u8B49\u65B9\u5F0F\u9023\u7DDA\uFF0C\u8ACB\u4E00\u4F75\u6E05\u7A7A user"
-      ]);
-    }
-    const userInfo = user ? `${encodeURIComponent(user)}:${encodeURIComponent(password)}@` : "";
-    const scheme = srv ? "mongodb+srv://" : "mongodb://";
-    const authority = srv ? host : `${host}:${port}`;
-    const path = database ? `/${encodeURIComponent(database)}` : "/";
-    const query = new URLSearchParams;
-    if (user)
-      query.set("authSource", authSource || "admin");
-    if (replicaSet)
-      query.set("replicaSet", replicaSet);
-    if (tls !== undefined)
-      query.set("tls", String(tls));
-    const search = query.toString();
-    return `${scheme}${userInfo}${authority}${path}${search ? `?${search}` : ""}`;
-  }
-  parseTxtRecords(records) {
-    const combined = records.flat().map((record) => record.replace(/^"|"$/g, "")).join("&");
-    if (!combined)
-      return {};
-    const params = new URLSearchParams(combined);
-    return Object.fromEntries(params.entries());
-  }
-  async resolveSrvHosts(hostname) {
-    const srvName = `_mongodb._tcp.${hostname}`;
-    try {
-      const records = await resolveSrv(srvName);
-      if (!records.length) {
-        throw new Error(`No SRV records found for ${srvName}`);
-      }
-      return records.map((record) => {
-        const target = String(record.name || record.target || "").replace(/\.$/, "");
-        return `${target}:${record.port}`;
-      });
-    } catch (error) {
-      const code = error?.code;
-      if (!["ECONNREFUSED", "ENOTFOUND", "ETIMEOUT", "ETIMEDOUT"].includes(code ?? "")) {
-        throw error;
-      }
-    }
-    const response = await fetch(`https://dns.google/resolve?name=${encodeURIComponent(srvName)}&type=SRV`);
-    if (!response.ok) {
-      throw new Error(`SRV lookup failed with HTTP ${response.status}`);
+function globNeverMatches(glob) {
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\") {
+      i++;
+      continue;
     }
-    const payload = await response.json();
-    if (payload.Status !== 0 || !payload.Answer?.length) {
-      throw new Error(payload.Comment || `No SRV records found for ${srvName}`);
+    if (c !== "[")
+      continue;
+    const end = findClassEnd(glob, i);
+    if (end === -1) {
+      return "unclosed character class";
     }
-    return payload.Answer.map((answer) => {
-      const parts = answer.data.trim().split(/\s+/);
-      const port = parts[2];
-      const target = parts.slice(3).join(" ").replace(/\.$/, "");
-      return `${target}:${port}`;
-    });
+    const body = glob.slice(i, end + 1);
+    if (body === "[]" || body === "[^]")
+      return "empty character class matches nothing";
+    if (!isValidCharacterClass(body))
+      return "invalid character class";
+    i = end;
   }
-  async resolveTxtOptions(hostname) {
-    try {
-      const records = await resolveTxt(hostname);
-      return this.parseTxtRecords(records);
-    } catch (error) {
-      const code = error?.code;
-      if (!["ECONNREFUSED", "ENOTFOUND", "ETIMEOUT", "ETIMEDOUT"].includes(code ?? "")) {
-        throw error;
-      }
-    }
-    const response = await fetch(`https://dns.google/resolve?name=${encodeURIComponent(hostname)}&type=TXT`);
-    if (!response.ok) {
-      throw new Error(`TXT lookup failed with HTTP ${response.status}`);
+  return null;
+}
+
+// src/core/mongo/path-matcher.ts
+function compilePatterns(raw) {
+  const patterns = [];
+  const rejected = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      rejected.push({ raw: String(entry ?? ""), reason: "must be a non-empty string" });
+      continue;
     }
-    const payload = await response.json();
-    if (payload.Status !== 0 || !payload.Answer?.length) {
-      return {};
+    const segments = entry.split(".");
+    if (segments.some((s) => s.length === 0)) {
+      rejected.push({ raw: entry, reason: "empty path segment" });
+      continue;
     }
-    return this.parseTxtRecords(payload.Answer.map((answer) => [answer.data]));
-  }
-  async buildResolvedUri() {
-    const canonical = this.buildUri();
-    if (!canonical.startsWith("mongodb+srv://")) {
-      return canonical;
-    }
-    const url = new URL(canonical);
-    const hosts = await this.resolveSrvHosts(url.hostname);
-    const txtOptions = await this.resolveTxtOptions(url.hostname);
-    const query = new URLSearchParams(url.searchParams);
-    for (const [key, value] of Object.entries(txtOptions)) {
-      if (!query.has(key)) {
-        query.set(key, value);
-      }
-    }
-    if (!query.has("tls") && !query.has("ssl")) {
-      query.set("tls", "true");
-    }
-    if ((url.username || url.password) && !query.has("authSource")) {
-      query.set("authSource", "admin");
-    }
-    const userInfo = url.username || url.password ? `${encodeURIComponent(decodeURIComponent(url.username))}${url.password ? `:${encodeURIComponent(decodeURIComponent(url.password))}` : ""}@` : "";
-    const path = url.pathname && url.pathname !== "/" ? url.pathname : `/${this.options.database || "test"}`;
-    const search = query.toString();
-    return `mongodb://${userInfo}${hosts.join(",")}${path}${search ? `?${search}` : ""}`;
-  }
-  connectionHints(error, message) {
-    const AUTH_HINTS = [
-      "\u8A8D\u8B49\u5931\u6557\uFF1A\u8ACB\u78BA\u8A8D user / password \u6B63\u78BA",
-      "\u8ACB\u78BA\u8A8D authSource \u6307\u5411\u5B58\u653E\u8A72\u5E33\u865F\u7684\u8CC7\u6599\u5EAB\uFF08Atlas \u8207\u591A\u6578\u81EA\u67B6\u74B0\u5883\u70BA admin\uFF09"
-    ];
-    const DNS_HINTS = [
-      "DNS/SRV \u89E3\u6790\u5931\u6557\uFF1A\u8ACB\u78BA\u8A8D host \u70BA SRV \u7DB2\u57DF\uFF0C\u4E14 srv \u8A2D\u5B9A\u8207\u5B83\u4E00\u81F4",
-      "\u82E5\u8A72\u4E3B\u6A5F\u4E0D\u662F SRV \u7DB2\u57DF\uFF0C\u8ACB\u95DC\u9589 srv \u4E26\u6539\u586B host \u8207 port",
-      "\u8ACB\u78BA\u8A8D\u672C\u6A5F DNS \u6216\u7DB2\u8DEF\uFF08VPN\u3001\u516C\u53F8\u7DB2\u8DEF\uFF09\u5141\u8A31 SRV \u67E5\u8A62"
-    ];
-    const TLS_HINTS = [
-      "TLS \u63E1\u624B\u5931\u6557\uFF1A\u8ACB\u78BA\u8A8D tls \u6B04\u4F4D\u8A2D\u5B9A\u8207\u4F3A\u670D\u5668\u4E00\u81F4",
-      "\u81EA\u7C3D\u6191\u8B49\u74B0\u5883\u9700\u8981\u5728\u4F3A\u670D\u5668\u7AEF\u6216\u7CFB\u7D71\u4FE1\u4EFB\u93C8\u4E2D\u5B89\u88DD CA \u6191\u8B49"
-    ];
-    const err = error;
-    const causeCode = String(err?.cause?.code ?? err?.code ?? "");
-    if (err?.code === 18 || err?.codeName === "AuthenticationFailed")
-      return AUTH_HINTS;
-    if (["ENOTFOUND", "EAI_AGAIN"].includes(causeCode))
-      return DNS_HINTS;
-    if (causeCode.startsWith("ERR_TLS") || causeCode.startsWith("SELF_SIGNED"))
-      return TLS_HINTS;
-    if (/authentication failed|not authorized|bad auth/i.test(message))
-      return AUTH_HINTS;
-    if (/querySrv|getaddrinfo (ENOTFOUND|EAI_AGAIN)/i.test(message))
-      return DNS_HINTS;
-    if (/unable to verify the first certificate|self.signed certificate|certificate has expired|ERR_TLS/i.test(message)) {
-      return TLS_HINTS;
-    }
-    return ["\u8ACB\u78BA\u8A8D MongoDB \u670D\u52D9\u6B63\u5728\u57F7\u884C", "\u8ACB\u78BA\u8A8D\u9023\u7DDA\u8A2D\u5B9A\uFF08URI \u6216 host/port\uFF09\u6B63\u78BA"];
-  }
-  getDatabase() {
-    if (!this.client) {
-      throw new ConnectionError("UNKNOWN", "\u5C1A\u672A\u9023\u7DDA\uFF0C\u8ACB\u5148\u547C\u53EB connect()", []);
-    }
-    return this.client.db(this.options.database || undefined);
-  }
-  async connect() {
-    const ClientClass = await this.resolveClientClass();
-    const uri = await this.buildResolvedUri();
-    try {
-      this.client = new ClientClass(uri, { serverSelectionTimeoutMS: this.options.timeout ?? 5000 });
-      await this.client.connect();
-    } catch (err) {
-      const message = err.message ?? "Unknown error";
-      const code = message.includes("ECONNREFUSED") ? "ECONNREFUSED" : message.includes("ETIMEDOUT") ? "ETIMEDOUT" : "UNKNOWN";
-      throw new ConnectionError(code, `MongoDB \u9023\u7DDA\u5931\u6557: ${message}`, this.connectionHints(err, message));
+    const globstar = segments.find((seg) => seg.includes("**"));
+    if (globstar !== undefined) {
+      rejected.push({
+        raw: entry,
+        reason: "`**` matches one segment, not a subtree; write `*` or a longer path"
+      });
+      continue;
     }
-  }
-  async disconnect() {
-    if (this.client) {
-      await this.client.close();
-      this.client = null;
+    const dead = segments.map((seg) => globNeverMatches(seg)).find((r) => r !== null);
+    if (dead !== undefined && dead !== null) {
+      rejected.push({ raw: entry, reason: dead });
+      continue;
     }
+    const wildcardTail = segments.length > 1 && segments[segments.length - 1] === "*";
+    const literal = wildcardTail ? segments.slice(0, -1) : segments;
+    patterns.push({
+      raw: entry,
+      segments: literal,
+      wildcardTail
+    });
   }
-  async execute(query, params, options) {
-    const db = this.getDatabase();
-    const collectionName = params?.[0];
-    const collection = db.collection(collectionName);
-    let parsed;
-    try {
-      parsed = JSON.parse(query);
-    } catch {
-      throw new Error("MongoDB \u67E5\u8A62\u5FC5\u9808\u662F\u6709\u6548\u7684 JSON\uFF08object filter \u6216 array pipeline\uFF09");
-    }
-    assertNoMongoServerSideScript(parsed);
-    const limit = options?.limit;
-    let docs;
-    if (Array.isArray(parsed)) {
-      const stages = parsed;
-      const alreadyHasLimit = stages.some((stage) => stage !== null && typeof stage === "object" && ("$limit" in stage));
-      const limitedStages = typeof limit === "number" && limit > 0 && !alreadyHasLimit ? [...stages, { $limit: limit }] : stages;
-      const finalStages = options?.projection ? [...limitedStages, { $project: options.projection }] : limitedStages;
-      docs = await collection.aggregate(finalStages).toArray();
+  return { patterns, rejected };
+}
+function matchAny(path, patterns) {
+  if (patterns.length === 0)
+    return false;
+  const pathSegments = path.split(".");
+  for (const pat of patterns) {
+    if (pat.wildcardTail) {
+      if (pathSegments.length < pat.segments.length)
+        continue;
     } else {
-      const cap2 = typeof limit === "number" && limit > 0 ? limit : 0;
-      const cursor = options?.projection ? collection.find(parsed, { projection: options.projection }) : collection.find(parsed);
-      docs = await cursor.limit(cap2).toArray();
+      if (pat.segments.length !== pathSegments.length)
+        continue;
     }
-    return { rows: docs, affectedRows: docs.length };
-  }
-  async listCollections() {
-    const db = this.getDatabase();
-    const colls = await db.listCollections().toArray();
-    const results = await Promise.all(colls.map(async (col) => {
-      try {
-        const count = await db.collection(col.name).estimatedDocumentCount();
-        return { name: col.name, documentCount: count };
-      } catch {
-        return { name: col.name };
-      }
-    }));
-    return results;
-  }
-  async listTables() {
-    const collections = await this.listCollections();
-    return collections.map((c) => ({
-      name: c.name,
-      estimatedRowCount: c.documentCount,
-      columns: []
-    }));
-  }
-  async getTableSchema(collectionName, options) {
-    const db = this.getDatabase();
-    const collection = db.collection(collectionName);
-    const estimatedRowCount = await collection.estimatedDocumentCount();
-    const requested = options?.sampleSize;
-    const desired = typeof requested === "number" && requested >= 1 ? requested : 100;
-    const sampleSize = Math.min(desired, 1000);
-    const method = options?.sampleMethod ?? "random";
-    let samples = [];
-    if (method === "random") {
-      try {
-        samples = await collection.aggregate([{ $sample: { size: sampleSize } }]).toArray();
-      } catch (err) {
-        console.error(`[mongo] $sample failed (${err.message}); falling back to natural order.`);
-        samples = await collection.find().limit(sampleSize).toArray();
+    let ok = true;
+    for (let i = 0;i < pat.segments.length; i++) {
+      if (!globMatches(pat.segments[i], pathSegments[i])) {
+        ok = false;
+        break;
       }
-    } else {
-      samples = await collection.find().limit(sampleSize).toArray();
-    }
-    const accumulator = new Map;
-    for (const doc of samples)
-      accumulateDocPaths(doc, "", accumulator);
-    const denom = Math.max(samples.length, 1);
-    const columns = Array.from(accumulator.entries()).map(([name, info]) => ({
-      name,
-      type: Array.from(info.types).sort().join(" | "),
-      nullable: info.types.has("null") || info.count < denom,
-      presence: info.count / denom
-    }));
-    return {
-      name: collectionName,
-      columns,
-      estimatedRowCount,
-      tableType: "table"
-    };
-  }
-  async testConnection() {
-    if (!this.client)
-      return false;
-    await this.getDatabase().command({ ping: 1 });
-    return true;
-  }
-  async getServerVersion() {
-    const info = await this.getDatabase().admin().serverInfo();
-    return info.version ?? "unknown";
-  }
-  async insert(collection, data) {
-    const db = this.getDatabase();
-    const result = await db.collection(collection).insertOne(data);
-    return {
-      rows: [],
-      affectedRows: result.acknowledged ? 1 : 0,
-      lastInsertId: result.insertedId.toString()
-    };
-  }
-  async update(collection, filter, update) {
-    const db = this.getDatabase();
-    assertNoMongoServerSideScript(filter);
-    assertNoMongoServerSideScript(update);
-    const result = await db.collection(collection).updateMany(filter, update);
-    return {
-      rows: [],
-      affectedRows: result.modifiedCount
-    };
-  }
-  async delete(collection, filter) {
-    const db = this.getDatabase();
-    assertNoMongoServerSideScript(filter);
-    const result = await db.collection(collection).deleteMany(filter);
-    return {
-      rows: [],
-      affectedRows: result.deletedCount
-    };
-  }
-}
-function detectMongoType(v) {
-  if (v === null || v === undefined)
-    return "null";
-  if (Array.isArray(v))
-    return "array";
-  if (v instanceof Date)
-    return "Date";
-  if (typeof v === "object") {
-    const ctor = v.constructor?.name;
-    if (ctor === "ObjectId")
-      return "ObjectId";
-    if (ctor === "Binary")
-      return "Binary";
-    if (ctor === "Decimal128")
-      return "Decimal128";
-    return "object";
-  }
-  if (typeof v === "string")
-    return "string";
-  if (typeof v === "number")
-    return "number";
-  if (typeof v === "boolean")
-    return "boolean";
-  return "string";
-}
-function accumulateDocPaths(doc, prefix, acc) {
-  for (const [k, v] of Object.entries(doc)) {
-    const path = prefix === "" ? k : `${prefix}.${k}`;
-    const t2 = detectMongoType(v);
-    const slot = acc.get(path) ?? { types: new Set, count: 0 };
-    slot.types.add(t2);
-    slot.count += 1;
-    acc.set(path, slot);
-    if (t2 === "object" && v && typeof v === "object") {
-      accumulateDocPaths(v, path, acc);
     }
+    if (ok)
+      return true;
   }
+  return false;
 }
 
+// src/core/mongo/request-fields.ts
+var WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
+var RESHAPES_DOCUMENT = new Set(["$objectToArray", "$replaceRoot", "$replaceWith"]);
+
 // src/adapters/redis/command-metadata.ts
 var tbl = (s) => s;
 var REDIS_COMMAND_TABLE = Object.freeze({
   PING: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "query-only"
+    keyArity: { kind: "no-key" }
   }),
   INFO: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "query-only"
+    keyArity: { kind: "no-key" }
   }),
   DBSIZE: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "query-only"
+    keyArity: { kind: "no-key" }
   }),
   TYPE: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   EXISTS: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 },
-    permissionTier: "query-only"
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 }
   }),
   TTL: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   GET: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   MGET: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 },
-    permissionTier: "query-only"
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 }
   }),
   STRLEN: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HGET: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HEXISTS: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HLEN: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HMGET: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   LLEN: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   LINDEX: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SCARD: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SISMEMBER: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZCARD: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZSCORE: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   XLEN: tbl({
     readOnly: true,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SCAN: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-count", argIndex: 0 },
-    keyArity: { kind: "no-key" },
-    permissionTier: "query-only"
+    keyArity: { kind: "pattern-after-token", token: "MATCH" }
   }),
   HSCAN: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-count", argIndex: 1 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SSCAN: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-count", argIndex: 1 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZSCAN: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-count", argIndex: 1 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   LRANGE: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-stop", argIndex: 2 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZRANGE: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-stop", argIndex: 2 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZREVRANGE: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-stop", argIndex: 2 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZRANGEBYSCORE: tbl({
     readOnly: true,
     sizeGuard: { kind: "rewrite-limit", argIndex: 3 },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HGETALL: tbl({
     readOnly: true,
     sizeGuard: { kind: "truncate" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HKEYS: tbl({
     readOnly: true,
     sizeGuard: { kind: "truncate" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HVALS: tbl({
     readOnly: true,
     sizeGuard: { kind: "truncate" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SMEMBERS: tbl({
     readOnly: true,
     sizeGuard: { kind: "truncate" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   KEYS: tbl({
     readOnly: true,
     sizeGuard: { kind: "truncate" },
-    keyArity: { kind: "pattern", argIndex: 0 },
-    permissionTier: "query-only"
+    keyArity: { kind: "pattern", argIndex: 0 }
   }),
   SET: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SETEX: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   MSET: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-variable", startIndex: 0, step: 2 },
-    permissionTier: "read-write"
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 2 }
   }),
   HSET: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HMSET: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   HDEL: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   RPUSH: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   LPUSH: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   LREM: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SADD: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   SREM: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZADD: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   ZREM: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   DEL: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 },
-    permissionTier: "read-write"
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 }
   }),
   UNLINK: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 },
-    permissionTier: "read-write"
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 1 }
   }),
   EXPIRE: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   PERSIST: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "single", argIndex: 0 },
-    permissionTier: "read-write"
+    keyArity: { kind: "single", argIndex: 0 }
   }),
   RENAME: tbl({
     readOnly: false,
     sizeGuard: { kind: "unbounded" },
-    keyArity: { kind: "multi-fixed", argIndices: [0, 1] },
-    permissionTier: "read-write"
+    keyArity: { kind: "multi-fixed", argIndices: [0, 1] }
   }),
   FLUSHDB: tbl({
     readOnly: false,
     sizeGuard: { kind: "reject", reason: "FLUSHDB destroys data" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "admin"
+    keyArity: { kind: "no-key" }
   }),
   FLUSHALL: tbl({
     readOnly: false,
     sizeGuard: { kind: "reject", reason: "FLUSHALL destroys data" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "admin"
+    keyArity: { kind: "no-key" }
   }),
   SHUTDOWN: tbl({
     readOnly: false,
     sizeGuard: { kind: "reject", reason: "SHUTDOWN stops the server" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "admin"
+    keyArity: { kind: "no-key" }
   }),
   DEBUG: tbl({
     readOnly: false,
     sizeGuard: { kind: "reject", reason: "DEBUG is unsafe" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "admin"
+    keyArity: { kind: "no-key" }
   }),
-  "CONFIG SET": tbl({
+  PTTL: tbl({
+    readOnly: true,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  SETNX: tbl({
     readOnly: false,
-    sizeGuard: { kind: "reject", reason: "CONFIG SET mutates server state" },
-    keyArity: { kind: "no-key" },
-    permissionTier: "admin"
-  })
-});
-function getCommandSpec(name) {
-  return REDIS_COMMAND_TABLE[name.toUpperCase()];
-}
-
-// src/adapters/redis/types.ts
-class BlacklistRejection extends Error {
-  command;
-  matchedKey;
-  matchedPattern;
-  constructor(message, command, matchedKey, matchedPattern) {
-    super(message);
-    this.command = command;
-    this.matchedKey = matchedKey;
-    this.matchedPattern = matchedPattern;
-    this.name = "BlacklistRejection";
-    Object.setPrototypeOf(this, BlacklistRejection.prototype);
-  }
-}
-var REDIS_LIMIT_DEFAULT = 1000;
-
-// src/adapters/redis/size-guard.ts
-function rewriteArgs(command, args, opts) {
-  if (opts.noLimit)
-    return { rewritten: args };
-  const spec = getCommandSpec(command);
-  if (!spec)
-    return { rewritten: args };
-  const original = args;
-  switch (spec.sizeGuard.kind) {
-    case "rewrite-count":
-      return rewriteCount(command, args, original);
-    case "rewrite-stop":
-      return rewriteStop(command, args, spec.sizeGuard.argIndex, original);
-    case "rewrite-limit":
-      return rewriteLimit(command, args, original);
-    default:
-      return { rewritten: args };
-  }
-}
-function rewriteCount(command, args, original) {
-  const idx = args.findIndex((a) => a.toUpperCase() === "COUNT");
-  if (idx === -1) {
-    const rewritten = [...args, "COUNT", String(REDIS_LIMIT_DEFAULT)];
-    return { rewritten, warning: { code: "REDIS_SIZE_REWRITE", command, original, rewritten } };
-  }
-  const n = parseInt(args[idx + 1] ?? "0", 10);
-  if (n > REDIS_LIMIT_DEFAULT) {
-    const rewritten = [...args];
-    rewritten[idx + 1] = String(REDIS_LIMIT_DEFAULT);
-    return { rewritten, warning: { code: "REDIS_SIZE_REWRITE", command, original, rewritten } };
-  }
-  return { rewritten: args };
-}
-function rewriteStop(command, args, stopIdx, original) {
-  const startStr = args[stopIdx - 1] ?? "0";
-  const stopStr = args[stopIdx];
-  if (stopStr === undefined)
-    return { rewritten: args };
-  const start = parseInt(startStr, 10) || 0;
-  const stop = parseInt(stopStr, 10);
-  const span = stop === -1 ? Infinity : stop - start + 1;
-  if (span > REDIS_LIMIT_DEFAULT) {
-    const rewritten = [...args];
-    rewritten[stopIdx] = String(start + REDIS_LIMIT_DEFAULT - 1);
-    return { rewritten, warning: { code: "REDIS_SIZE_REWRITE", command, original, rewritten } };
-  }
-  return { rewritten: args };
-}
-function rewriteLimit(command, args, original) {
-  const idx = args.findIndex((a) => a.toUpperCase() === "LIMIT");
-  if (idx === -1) {
-    const rewritten = [...args, "LIMIT", "0", String(REDIS_LIMIT_DEFAULT)];
-    return { rewritten, warning: { code: "REDIS_SIZE_REWRITE", command, original, rewritten } };
-  }
-  const n = parseInt(args[idx + 2] ?? "0", 10);
-  if (n > REDIS_LIMIT_DEFAULT) {
-    const rewritten = [...args];
-    rewritten[idx + 2] = String(REDIS_LIMIT_DEFAULT);
-    return { rewritten, warning: { code: "REDIS_SIZE_REWRITE", command, original, rewritten } };
-  }
-  return { rewritten: args };
-}
-function truncateResult(command, reply, opts) {
-  if (opts.noLimit)
-    return { value: reply };
-  const spec = getCommandSpec(command);
-  if (!spec || spec.sizeGuard.kind !== "truncate")
-    return { value: reply };
-  if (Array.isArray(reply)) {
-    if (reply.length > REDIS_LIMIT_DEFAULT) {
-      const droppedAtLeast = reply.length - REDIS_LIMIT_DEFAULT;
-      const value = reply.slice(0, REDIS_LIMIT_DEFAULT);
-      return {
-        value,
-        warning: {
-          code: "REDIS_SIZE_TRUNCATE",
-          command,
-          kept: REDIS_LIMIT_DEFAULT,
-          droppedAtLeast
-        }
-      };
-    }
-    return { value: reply };
-  }
-  if (reply && typeof reply === "object") {
-    const obj = reply;
-    const keys = Object.keys(obj);
-    if (keys.length > REDIS_LIMIT_DEFAULT) {
-      const dropped = keys.length - REDIS_LIMIT_DEFAULT;
-      const truncated = {};
-      for (let i = 0;i < REDIS_LIMIT_DEFAULT; i++)
-        truncated[keys[i]] = obj[keys[i]];
-      return {
-        value: truncated,
-        warning: {
-          code: "REDIS_SIZE_TRUNCATE",
-          command,
-          kept: REDIS_LIMIT_DEFAULT,
-          droppedAtLeast: dropped
-        }
-      };
-    }
-  }
-  return { value: reply };
-}
-
-// src/utils/glob.ts
-function globToRegex(glob) {
-  let out = "^";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "\\" && i + 1 < glob.length) {
-      out += glob[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      continue;
-    }
-    if (c === "*")
-      out += ".*";
-    else if (c === "?")
-      out += ".";
-    else if (c === "[") {
-      const end = findClassEnd(glob, i);
-      const body = end === -1 ? "" : glob.slice(i, end + 1);
-      if (body !== "" && isValidCharacterClass(body)) {
-        out += body;
-        i = end;
-      } else {
-        out += "\\[";
-      }
-    } else if (".^$+(){}|\\".includes(c)) {
-      out += "\\" + c;
-    } else {
-      out += c;
-    }
-  }
-  out += "$";
-  return new RegExp(out);
-}
-function findClassEnd(glob, open) {
-  for (let i = open + 1;i < glob.length; i++) {
-    if (glob[i] === "\\") {
-      i++;
-      continue;
-    }
-    if (glob[i] === "]")
-      return i;
-  }
-  return -1;
-}
-function isValidCharacterClass(body) {
-  try {
-    new RegExp(body);
-    return true;
-  } catch {
-    return false;
-  }
-}
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  PSETEX: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  APPEND: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  INCR: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  INCRBY: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  DECR: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  DECRBY: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  HSETNX: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  HINCRBY: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  LPOP: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  RPOP: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  LSET: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  XADD: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  XDEL: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  XRANGE: tbl({
+    readOnly: true,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  XREVRANGE: tbl({
+    readOnly: true,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  EXPIREAT: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  PEXPIRE: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "single", argIndex: 0 }
+  }),
+  MSETNX: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "multi-variable", startIndex: 0, step: 2 }
+  }),
+  XREAD: tbl({
+    readOnly: true,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "after-token", token: "STREAMS" }
+  }),
+  ECHO: tbl({
+    readOnly: true,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  CONFIG: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  CLIENT: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  MONITOR: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  SAVE: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  BGSAVE: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  BGREWRITEAOF: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  REPLICAOF: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  SLAVEOF: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  ACL: tbl({
+    readOnly: false,
+    sizeGuard: { kind: "unbounded" },
+    keyArity: { kind: "no-key" }
+  }),
+  "CONFIG SET": tbl({
+    readOnly: false,
+    sizeGuard: { kind: "reject", reason: "CONFIG SET mutates server state" },
+    keyArity: { kind: "no-key" }
+  })
+});
 
-// src/adapters/redis/blacklist-enforcer.ts
-function patternsOverlap(a, b) {
-  const ra = globToRegex(a);
-  const rb = globToRegex(b);
-  const probeA = sampleFromGlob(a);
-  const probeB = sampleFromGlob(b);
-  if (probeA !== null && rb.test(probeA))
-    return true;
-  if (probeB !== null && ra.test(probeB))
-    return true;
-  return false;
-}
-function sampleFromGlob(glob) {
-  let s = "";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*")
-      s += "__star__";
-    else if (c === "?")
-      s += "x";
-    else if (c === "[") {
-      const end = glob.indexOf("]", i);
-      if (end === -1)
-        return null;
-      const first = glob[i + 1];
-      if (!first)
-        return null;
-      s += first;
-      i = end;
-    } else
-      s += c;
-  }
-  return s;
-}
-function checkKeyArgs(command, args, rules) {
-  if (rules.length === 0)
-    return { ok: true };
-  const spec = getCommandSpec(command);
-  if (!spec)
-    return { ok: true };
-  const keyIndexes = expandKeyArity(spec.keyArity, args.length);
-  for (const idx of keyIndexes) {
-    const key = args[idx];
-    if (key === undefined)
-      continue;
-    for (const pat of rules) {
-      if (globToRegex(pat).test(key)) {
-        return { ok: false, matchedKey: key, matchedPattern: pat };
-      }
-    }
-  }
-  if (spec.keyArity.kind === "pattern") {
-    const userPat = args[spec.keyArity.argIndex];
-    if (userPat !== undefined) {
-      for (const pat of rules) {
-        if (patternsOverlap(userPat, pat)) {
-          return { ok: false, matchedKey: null, matchedPattern: pat };
-        }
-      }
-    }
-  }
-  return { ok: true };
-}
-function expandKeyArity(arity, argCount) {
-  switch (arity.kind) {
-    case "no-key":
-    case "pattern":
-      return [];
-    case "single":
-      return [arity.argIndex];
-    case "multi-fixed":
-      return arity.argIndices;
-    case "multi-variable": {
-      const indices = [];
-      for (let i = arity.startIndex;i < argCount; i += arity.step)
-        indices.push(i);
-      return indices;
-    }
-  }
-}
+// src/adapters/redis/returned-key-names.ts
+var RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
 
 // src/adapters/redis/value-masker.ts
-var REDACTED = "[REDACTED]";
 var MASKABLE = new Set(["GET", "GETRANGE", "HGETALL", "HGET", "HMGET", "HVALS"]);
-function planFor(key, rules) {
-  const matched = rules.filter((r) => globToRegex(r.keyPattern).test(key));
-  if (matched.length === 0)
-    return null;
-  const wholeValue = matched.some((r) => !r.fields || r.fields.length === 0);
-  const fields = new Set(matched.flatMap((r) => r.fields ?? []));
-  return { wholeValue, fields };
-}
-function maskRedisRows(command, args, rows, rules) {
-  if (rules.length === 0)
-    return rows;
-  const head = command.toUpperCase();
-  if (!MASKABLE.has(head))
-    return rows;
-  const key = args[0];
-  if (key === undefined)
-    return rows;
-  const plan = planFor(key, rules);
-  if (!plan)
-    return rows;
-  if (head === "GET" || head === "GETRANGE") {
-    if (!plan.wholeValue)
-      return rows;
-    return rows.map((r) => ({ ...r, value: REDACTED }));
-  }
-  if (head === "HGETALL") {
-    return rows.map((row) => {
-      const out = {};
-      for (const [field, value] of Object.entries(row)) {
-        out[field] = plan.wholeValue || plan.fields.has(field) ? REDACTED : value;
-      }
-      return out;
-    });
-  }
-  if (head === "HGET") {
-    const field = args[1];
-    const hit = plan.wholeValue || field !== undefined && plan.fields.has(field);
-    return hit ? rows.map((r) => ({ ...r, value: REDACTED })) : rows;
-  }
-  if (head === "HMGET") {
-    return rows.map((row) => {
-      const idx = typeof row.index === "number" ? row.index : Number(row.index);
-      const field = args[1 + idx];
-      const hit = plan.wholeValue || field !== undefined && plan.fields.has(field);
-      return hit ? { ...row, value: REDACTED } : row;
-    });
-  }
-  if (head === "HVALS") {
-    if (!plan.wholeValue)
-      return rows;
-    return rows.map((r) => ({ ...r, value: REDACTED }));
-  }
-  return rows;
-}
-
-// src/adapters/redis-adapter.ts
-var REDIS_LIST_KEY_LIMIT = 1000;
-
-class RedisAdapter {
-  options;
-  ClientClass;
-  client = null;
-  blacklistRules = [];
-  constructor(options, ClientClass = null) {
-    this.options = options;
-    this.ClientClass = ClientClass;
-    if (options.port < 1 || options.port > 65535) {
-      throw new Error(`Invalid port number: ${options.port}`);
-    }
-  }
-  setBlacklistRules(rules) {
-    this.blacklistRules = rules;
-  }
-  maskRules = [];
-  setMaskRules(rules) {
-    this.maskRules = rules;
-  }
-  async resolveClientClass() {
-    if (this.ClientClass)
-      return this.ClientClass;
-    const mod = await Promise.resolve(globalThis.Bun);
-    return mod.RedisClient;
-  }
-  requireClient() {
-    if (!this.client) {
-      throw new ConnectionError("UNKNOWN", "\u5C1A\u672A\u9023\u7DDA\uFF0C\u8ACB\u5148\u547C\u53EB connect()", ["\u8ACB\u5148\u547C\u53EB connect()"]);
-    }
-    return this.client;
-  }
-  async connect() {
-    const ClientClass = await this.resolveClientClass();
-    const url = buildRedisUrl(this.options);
-    try {
-      this.client = new ClientClass(url, {
-        connectionTimeout: this.options.timeout ?? 5000,
-        autoReconnect: false,
-        maxRetries: 0,
-        enableOfflineQueue: false
-      });
-      try {
-        this.client.onclose = () => {};
-      } catch {}
-      await this.client.connect();
-    } catch (err) {
-      try {
-        this.client?.close?.();
-      } catch {}
-      this.client = null;
-      const message = err.message ?? "Unknown error";
-      const code = inferConnectionCode(message, err.code);
-      throw new ConnectionError(code, `Redis \u9023\u7DDA\u5931\u6557: ${message}`, [
-        "\u8ACB\u78BA\u8A8D Redis \u670D\u52D9\u6B63\u5728\u57F7\u884C\uFF08\u4F8B\u5982\uFF1Aredis-cli ping\uFF09",
-        `\u8ACB\u78BA\u8A8D host/port \u6B63\u78BA\uFF1A${this.options.host}:${this.options.port}`,
-        "\u82E5\u6709\u8A2D\u5BC6\u78BC\u8ACB\u78BA\u8A8D password \u8207 ACL \u8A2D\u5B9A\u4E00\u81F4"
-      ]);
-    }
-  }
-  async disconnect() {
-    if (!this.client)
-      return;
-    try {
-      this.client.close();
-    } catch {} finally {
-      this.client = null;
-    }
-  }
-  async testConnection() {
-    const client = this.requireClient();
-    const reply = await client.send("PING", []);
-    return reply === "PONG";
-  }
-  async getServerVersion() {
-    const client = this.requireClient();
-    const info = await client.send("INFO", ["server"]);
-    const match = info.match(/^redis_version:(.+)$/m);
-    return match?.[1]?.trim() ?? "unknown";
-  }
-  async listCollections(options) {
-    const { names } = await this.sampleKeyNames(options?.limit ?? REDIS_LIST_KEY_LIMIT);
-    return names.map((name) => ({ name }));
-  }
-  async sampleKeyNames(limit) {
-    const client = this.requireClient();
-    const rules = this.blacklistRules;
-    const regexes = rules.map((p) => globToRegex(p));
-    const { keys, scanned } = await scanAllKeys(client, "*", limit, limit, (key) => regexes.every((r) => !r.test(key)));
-    return { names: keys, truncated: scanned >= limit };
-  }
-  async getDbSize() {
-    const client = this.requireClient();
-    const reply = await client.send("DBSIZE", []);
-    return reply;
-  }
-  async listTables() {
-    const collections = await this.listCollections();
-    return collections.map((c) => ({ name: c.name, columns: [] }));
-  }
-  async getTableSchema(keyName) {
-    const blk = checkKeyArgs("GET", [keyName], this.blacklistRules);
-    if (!blk.ok) {
-      throw new BlacklistRejection(`BlacklistRejection: schema lookup on key '${keyName}' rejected
-  matched blacklist pattern: ${blk.matchedPattern}`, "SCHEMA", keyName, blk.matchedPattern);
-    }
-    const client = this.requireClient();
-    const type = await client.send("TYPE", [keyName]);
-    if (type === "none") {
-      return { name: keyName, columns: [], tableType: "table" };
-    }
-    const ttl = await client.ttl(keyName);
-    const sizeInfo = await readSizeInfo(client, keyName, type);
-    const columns = [
-      { name: "type", type, nullable: false },
-      {
-        name: "ttl",
-        type: ttl >= 0 ? `${ttl}s` : ttl === -1 ? "no expiry" : "missing",
-        nullable: false
-      },
-      { name: "size", type: String(sizeInfo.size), nullable: false }
-    ];
-    if (sizeInfo.sample) {
-      columns.push({ name: "sample", type: sizeInfo.sample, nullable: true });
-    }
-    return {
-      name: keyName,
-      columns,
-      tableType: "table",
-      estimatedRowCount: sizeInfo.size
-    };
-  }
-  async dispatchCommand(head, rest) {
-    const client = this.requireClient();
-    const reply = await client.send(head, rest);
-    return wrapReply(head, reply);
-  }
-  async execute(command, _params, options) {
-    const tokens = parseRedisCommand(command);
-    if (tokens.length === 0) {
-      throw new Error("Redis \u6307\u4EE4\u4E0D\u53EF\u70BA\u7A7A");
-    }
-    const head = String(tokens[0]).toUpperCase();
-    const rest = tokens.slice(1).map(String);
-    const blk = checkKeyArgs(head, rest, this.blacklistRules);
-    if (!blk.ok) {
-      const msg = blk.matchedKey ? `BlacklistRejection: command ${head} on key '${blk.matchedKey}' rejected
-  matched blacklist pattern: ${blk.matchedPattern}` : `BlacklistRejection: ${head} pattern overlaps blacklist pattern: ${blk.matchedPattern}`;
-      throw new BlacklistRejection(msg, head, blk.matchedKey ?? null, blk.matchedPattern);
-    }
-    const noLimit = options?.noLimit === true;
-    const rw = rewriteArgs(head, rest, { noLimit });
-    const warnings = [];
-    if (rw.warning)
-      warnings.push(rw.warning);
-    const spec = getCommandSpec(head);
-    if (spec?.sizeGuard.kind === "truncate") {
-      const client = this.requireClient();
-      const rawReply = await client.send(head, rw.rewritten);
-      const tr = truncateResult(head, rawReply, { noLimit });
-      if (tr.warning)
-        warnings.push(tr.warning);
-      const rows2 = wrapReply(head, tr.value);
-      const masked2 = maskRedisRows(head, rest, rows2, this.maskRules);
-      return finishResult(masked2, warnings);
-    }
-    const rows = await this.dispatchCommand(head, rw.rewritten);
-    const masked = maskRedisRows(head, rest, rows, this.maskRules);
-    return finishResult(masked, warnings);
-  }
-  async insert(keyName, data) {
-    const client = this.requireClient();
-    const type = data.__type ?? "string";
-    if (type === "string") {
-      const value = String(data.value ?? "");
-      await client.set(keyName, value);
-      if (typeof data.ttl === "number" && data.ttl > 0) {
-        await client.expire(keyName, data.ttl);
-      }
-      return { rows: [], affectedRows: 1 };
-    }
-    if (type === "hash") {
-      const fields = data.fields;
-      if (!fields)
-        throw new Error("hash insert \u9700\u8981 fields \u7269\u4EF6");
-      const flat = [];
-      for (const [k, v] of Object.entries(fields))
-        flat.push(k, String(v));
-      await client.hmset(keyName, flat);
-      return { rows: [], affectedRows: Object.keys(fields).length };
-    }
-    if (type === "list") {
-      const values = data.values;
-      if (!values || !Array.isArray(values))
-        throw new Error("list insert \u9700\u8981 values \u9663\u5217");
-      await client.send("RPUSH", [keyName, ...values.map(String)]);
-      return { rows: [], affectedRows: values.length };
-    }
-    if (type === "set") {
-      const values = data.values;
-      if (!values || !Array.isArray(values))
-        throw new Error("set insert \u9700\u8981 values \u9663\u5217");
-      await client.send("SADD", [keyName, ...values.map(String)]);
-      return { rows: [], affectedRows: values.length };
-    }
-    if (type === "zset") {
-      const members = data.members;
-      if (!members)
-        throw new Error("zset insert \u9700\u8981 members \u7269\u4EF6 (member -> score)");
-      const flat = [];
-      for (const [m, s] of Object.entries(members))
-        flat.push(String(s), m);
-      await client.send("ZADD", [keyName, ...flat]);
-      return { rows: [], affectedRows: Object.keys(members).length };
-    }
-    throw new Error(`\u4E0D\u652F\u63F4\u7684 insert \u985E\u578B: ${String(type)}`);
-  }
-  async update(keyName, _filter, update) {
-    const client = this.requireClient();
-    const fields = update.fields;
-    if (fields) {
-      const flat = [];
-      for (const [k, v] of Object.entries(fields))
-        flat.push(k, String(v));
-      await client.hmset(keyName, flat);
-      return { rows: [], affectedRows: Object.keys(fields).length };
-    }
-    const type = update.__type;
-    if (type === "list") {
-      const values = update.values;
-      await client.send("RPUSH", [keyName, ...values.map(String)]);
-      return { rows: [], affectedRows: values.length };
-    }
-    if (type === "set") {
-      const values = update.values;
-      await client.send("SADD", [keyName, ...values.map(String)]);
-      return { rows: [], affectedRows: values.length };
-    }
-    if (type === "zset") {
-      const members = update.members;
-      const flat = [];
-      for (const [m, s] of Object.entries(members))
-        flat.push(String(s), m);
-      await client.send("ZADD", [keyName, ...flat]);
-      return { rows: [], affectedRows: Object.keys(members).length };
-    }
-    if ("value" in update) {
-      await client.set(keyName, String(update.value));
-      return { rows: [], affectedRows: 1 };
-    }
-    throw new Error("update \u9700\u8981 fields, values, members \u6216 value");
-  }
-  async delete(keyName, filter) {
-    const client = this.requireClient();
-    const field = filter.field;
-    if (field) {
-      const removed2 = await client.send("HDEL", [keyName, field]);
-      return { rows: [], affectedRows: removed2 };
-    }
-    const value = filter.value;
-    if (value) {
-      const type = await client.send("TYPE", [keyName]);
-      let removed2 = 0;
-      if (type === "list") {
-        removed2 = await client.send("LREM", [keyName, "0", value]);
-      } else if (type === "set") {
-        removed2 = await client.send("SREM", [keyName, value]);
-      } else if (type === "zset") {
-        removed2 = await client.send("ZREM", [keyName, value]);
-      }
-      return { rows: [], affectedRows: removed2 };
-    }
-    const removed = await client.del(keyName);
-    return { rows: [], affectedRows: removed };
-  }
-}
-function finishResult(rows, warnings) {
-  const columnNames = rows[0] ? Object.keys(rows[0]) : ["value"];
-  return {
-    rows,
-    affectedRows: rows.length,
-    rowCount: rows.length,
-    columnNames,
-    ...warnings.length > 0 ? { warnings } : {}
-  };
-}
-function buildRedisUrl(opts) {
-  let auth = "";
-  if (opts.user || opts.password) {
-    const u = encodeURIComponent(opts.user || "");
-    const p = encodeURIComponent(opts.password || "");
-    auth = `${u}:${p}@`;
-  }
-  const dbPart = opts.database ? `/${opts.database}` : "";
-  return `redis://${auth}${opts.host}:${opts.port}${dbPart}`;
-}
-function inferConnectionCode(message, driverCode) {
-  const m = message.toLowerCase();
-  if (driverCode === "ERR_REDIS_AUTHENTICATION_FAILED")
-    return "AUTH_FAILED";
-  if (driverCode === "ERR_REDIS_CONNECTION_CLOSED")
-    return "ECONNREFUSED";
-  if (driverCode === "ECONNREFUSED" || m.includes("econnrefused") || m.includes("refused")) {
-    return "ECONNREFUSED";
-  }
-  if (driverCode === "ETIMEDOUT" || m.includes("timeout") || m.includes("timed out")) {
-    return "ETIMEDOUT";
-  }
-  if (driverCode === "ENOTFOUND" || m.includes("enotfound") || m.includes("getaddrinfo")) {
-    return "ENOTFOUND";
-  }
-  if (m.includes("noauth") || m.includes("wrongpass") || m.includes("auth")) {
-    return "AUTH_FAILED";
-  }
-  return "UNKNOWN";
-}
-function parseRedisCommand(input) {
-  const tokens = [];
-  let buf = "";
-  let quote = null;
-  let i = 0;
-  let inToken = false;
-  const push = () => {
-    tokens.push(buf);
-    buf = "";
-    inToken = false;
-  };
-  while (i < input.length) {
-    const ch = input[i];
-    if (quote) {
-      if (ch === "\\" && i + 1 < input.length) {
-        buf += input[i + 1];
-        i += 2;
-        continue;
-      }
-      if (ch === quote) {
-        quote = null;
-        i++;
-        continue;
-      }
-      buf += ch;
-      i++;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      inToken = true;
-      i++;
-      continue;
-    }
-    if (/\s/.test(ch)) {
-      if (inToken)
-        push();
-      i++;
-      continue;
-    }
-    if (ch === "\\" && i + 1 < input.length) {
-      buf += input[i + 1];
-      i += 2;
-      inToken = true;
-      continue;
-    }
-    buf += ch;
-    inToken = true;
-    i++;
-  }
-  if (quote) {
-    throw new Error("Redis \u6307\u4EE4\u542B\u6709\u672A\u9589\u5408\u7684\u5F15\u865F");
-  }
-  if (inToken)
-    push();
-  return tokens;
-}
-async function scanAllKeys(client, pattern, count, maxKeys, accept = () => true) {
-  const seen = new Set;
-  const kept = new Set;
-  let cursor = "0";
-  do {
-    const reply = await client.send("SCAN", [
-      cursor,
-      "MATCH",
-      pattern,
-      "COUNT",
-      String(count)
-    ]);
-    const [next, batch] = reply;
-    for (const k of batch) {
-      if (seen.has(k))
-        continue;
-      seen.add(k);
-      if (accept(k))
-        kept.add(k);
-    }
-    cursor = next;
-    if (seen.size >= maxKeys)
-      break;
-  } while (cursor !== "0");
-  return { keys: Array.from(kept), scanned: seen.size };
-}
-async function readSizeInfo(client, key, type) {
-  switch (type) {
-    case "string": {
-      const len = await client.send("STRLEN", [key]);
-      return { size: len };
-    }
-    case "hash": {
-      const len = await client.send("HLEN", [key]);
-      const fields = await client.send("HKEYS", [key]);
-      return { size: len, sample: fields.slice(0, 5).join(", ") };
-    }
-    case "list": {
-      const len = await client.send("LLEN", [key]);
-      return { size: len };
-    }
-    case "set": {
-      const len = await client.send("SCARD", [key]);
-      return { size: len };
-    }
-    case "zset": {
-      const len = await client.send("ZCARD", [key]);
-      return { size: len };
-    }
-    case "stream": {
-      const len = await client.send("XLEN", [key]);
-      return { size: len };
-    }
-    default:
-      return { size: 0 };
-  }
-}
-function wrapReply(command, reply) {
-  const upper = command.toUpperCase();
-  if (reply === null || reply === undefined)
-    return [];
-  if (typeof reply === "string" || typeof reply === "number" || typeof reply === "boolean" || Buffer.isBuffer(reply)) {
-    return [{ value: reply.toString() }];
-  }
-  if (Array.isArray(reply)) {
-    if (upper === "HGETALL") {
-      const obj = {};
-      for (let i = 0;i < reply.length; i += 2) {
-        obj[String(reply[i])] = reply[i + 1];
-      }
-      return [obj];
-    }
-    return reply.map((value, idx) => ({ index: idx, value: String(value) }));
-  }
-  if (typeof reply === "object") {
-    return [reply];
-  }
-  return [{ value: String(reply) }];
-}
-
-// src/adapters/elasticsearch-adapter.ts
-class ElasticsearchAdapter {
-  options;
-  baseUrl = "";
-  currentNodeIndex = 0;
-  constructor(options) {
-    this.options = options;
-    this.baseUrl = this.resolveBaseUrl();
-  }
-  async connect() {
-    try {
-      await this.request("GET", "/");
-    } catch (error) {
-      if (error instanceof ConnectionError)
-        throw error;
-      throw new ConnectionError("UNKNOWN", `Could not connect to Elasticsearch: ${error.message}`, ["Check if Elasticsearch is running", "Verify host and port", "Check network connectivity"]);
-    }
-  }
-  async disconnect() {}
-  async execute(query, params, options) {
-    const indexName = params?.[0];
-    if (!indexName) {
-      throw new Error("Index name is required as the first parameter to execute()");
-    }
-    const isDsl = query.trim().startsWith("{");
-    const limit = options?.limit ?? 100;
-    let path = `/${encodeEsIndexExpression(indexName)}/_search`;
-    let body = undefined;
-    if (isDsl) {
-      body = JSON.parse(query);
-      assertNoElasticsearchScript(body);
-      if (body.size === undefined) {
-        body.size = limit;
-      }
-    } else {
-      path += `?q=${encodeURIComponent(query)}&size=${limit}`;
-    }
-    const response = await this.request(body ? "POST" : "GET", path, body);
-    const hits = response.hits?.hits || [];
-    const rows = hits.map((hit) => {
-      const row = { _id: hit._id };
-      this.flattenSource("", hit._source || {}, row);
-      return row;
-    });
-    return {
-      rows,
-      affectedRows: rows.length,
-      rowCount: rows.length,
-      columnNames: rows[0] ? Object.keys(rows[0]) : []
-    };
-  }
-  flattenSource(prefix, source, target) {
-    for (const [key, value] of Object.entries(source)) {
-      const fullKey = prefix ? `${prefix}.${key}` : key;
-      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-        this.flattenSource(fullKey, value, target);
-      } else {
-        target[fullKey] = value;
-      }
-    }
-  }
-  async listCollections(options) {
-    const rows = await this.request("GET", "/_cat/indices?format=json&h=index,docs.count&expand_wildcards=all");
-    return (Array.isArray(rows) ? rows : []).filter((row) => typeof row.index === "string" && row.index.length > 0).filter((row) => options?.includeSystem || !row.index.startsWith(".")).map((row) => {
-      const parsed = Number(row["docs.count"]);
-      return { name: row.index, documentCount: Number.isFinite(parsed) ? parsed : 0 };
-    });
-  }
-  async listTables(options) {
-    const collections = await this.listCollections(options);
-    return collections.map((c) => ({
-      name: c.name,
-      columns: [],
-      estimatedRowCount: c.documentCount,
-      tableType: "table"
-    }));
-  }
-  async getTableSchema(tableName, _options) {
-    const mapping = await this.request("GET", `/${encodeEsIndexExpression(tableName)}/_mapping`);
-    const indexMapping = mapping[tableName] || Object.values(mapping)[0];
-    if (!indexMapping) {
-      throw new Error(`Index not found: ${tableName}`);
-    }
-    const columns = [];
-    this.flattenProperties("", indexMapping.mappings?.properties || {}, columns);
-    return {
-      name: tableName,
-      columns,
-      tableType: "table"
-    };
-  }
-  flattenProperties(prefix, properties, columns) {
-    for (const [name, config] of Object.entries(properties)) {
-      const fullName = prefix ? `${prefix}.${name}` : name;
-      if (config.properties) {
-        this.flattenProperties(fullName, config.properties, columns);
-      } else {
-        columns.push({
-          name: fullName,
-          type: config.type || "object",
-          nullable: true
-        });
-        if (config.fields) {
-          for (const [fieldName, fieldConfig] of Object.entries(config.fields)) {
-            columns.push({
-              name: `${fullName}.${fieldName}`,
-              type: fieldConfig.type,
-              nullable: true
-            });
-          }
-        }
-      }
-    }
-  }
-  async testConnection() {
-    try {
-      await this.connect();
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async getServerVersion() {
-    const info = await this.request("GET", "/");
-    return info.version?.number ?? "unknown";
-  }
-  async insert(collection, data) {
-    const id = data._id || data.id;
-    const body = { ...data };
-    delete body._id;
-    delete body.id;
-    const encodedId = id ? encodeEsPathSegment(id) : "";
-    const response = await this.request("PUT", `/${encodeEsIndexExpression(collection)}/_doc/${encodedId}`, body);
-    return {
-      rows: [],
-      affectedRows: response.result === "created" || response.result === "updated" ? 1 : 0,
-      lastInsertId: response._id
-    };
-  }
-  async update(collection, filter, update) {
-    const id = filter._id || filter.id;
-    if (!id) {
-      throw new Error("Elasticsearch update requires _id or id in filter");
-    }
-    const response = await this.request("POST", `/${encodeEsIndexExpression(collection)}/_update/${encodeEsPathSegment(id)}`, {
-      doc: update
-    });
-    return {
-      rows: [],
-      affectedRows: response.result === "updated" || response.result === "noop" ? 1 : 0
-    };
-  }
-  async delete(collection, filter) {
-    const id = filter._id || filter.id;
-    if (!id) {
-      throw new Error("Elasticsearch delete requires _id or id in filter");
-    }
-    const response = await this.request("DELETE", `/${encodeEsIndexExpression(collection)}/_doc/${encodeEsPathSegment(id)}`);
-    return {
-      rows: [],
-      affectedRows: response.result === "deleted" ? 1 : 0
-    };
-  }
-  resolveBaseUrl() {
-    if (this.options.cloudId) {
-      return this.decodeCloudId(this.options.cloudId);
-    }
-    const nodes = this.options.nodes;
-    if (nodes && nodes.length > 0) {
-      return (nodes[0] ?? "").replace(/\/$/, "");
-    }
-    const protocol = this.options.protocol ?? "https";
-    const host = this.options.host || "localhost";
-    const port = this.options.port || 9200;
-    return `${protocol}://${host}:${port}`;
-  }
-  decodeCloudId(cloudId) {
-    try {
-      const parts = cloudId.split(":");
-      if (parts.length !== 2)
-        throw new Error("Invalid format");
-      const base64 = parts[1] ?? "";
-      const decoded = atob(base64);
-      const [hostAndPort = "", ...rest] = decoded.split("$");
-      if (hostAndPort.includes(".")) {
-        const [host = "", port] = hostAndPort.split(":");
-        return `https://${rest[0]}.${host}:${port || 443}`;
-      }
-      return `https://${rest[0]}.${hostAndPort}:443`;
-    } catch (error) {
-      throw new Error(`Invalid Cloud ID: ${error.message}`);
-    }
-  }
-  async getHeaders() {
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    if (this.options.apiKey) {
-      headers["Authorization"] = `ApiKey ${this.options.apiKey}`;
-    } else if (this.options.user && this.options.password) {
-      const auth = btoa(`${this.options.user}:${this.options.password}`);
-      headers["Authorization"] = `Basic ${auth}`;
-    }
-    return headers;
-  }
-  getBaseUrl() {
-    return this.baseUrl;
-  }
-  async request(method, path, body, options) {
-    const url = `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
-    const headers = await this.getHeaders();
-    const controller = new AbortController;
-    const timeout = options?.timeout ?? this.options.timeout ?? 5000;
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
-    try {
-      const response = await fetch(url, {
-        method,
-        headers,
-        body: body ? typeof body === "string" ? body : JSON.stringify(body) : undefined,
-        signal: controller.signal,
-        tls: {
-          rejectUnauthorized: this.options.rejectUnauthorized ?? true,
-          ca: this.options.caPath ? await Bun.file(this.options.caPath).text() : undefined
-        }
-      });
-      if (!response.ok) {
-        await this.handleErrorResponse(response);
-      }
-      return await response.json();
-    } catch (error) {
-      if (error.name === "AbortError") {
-        throw new ConnectionError("ETIMEDOUT", `Request timed out after ${timeout}ms`, [
-          "Increase timeout in config if the cluster is slow",
-          "Check if the network is congested"
-        ]);
-      }
-      if (error instanceof ConnectionError)
-        throw error;
-      const msg = error.message.toLowerCase();
-      if (msg.includes("connection refused") || msg.includes("econnrefused")) {
-        throw new ConnectionError("ECONNREFUSED", `Connection refused at ${this.baseUrl}`, [
-          "Check if Elasticsearch is running",
-          "Verify host and port"
-        ]);
-      }
-      if (msg.includes("not found") || msg.includes("enotfound")) {
-        throw new ConnectionError("ENOTFOUND", `Host not found: ${this.baseUrl}`, [
-          "Verify the hostname is correct",
-          "Check DNS settings"
-        ]);
-      }
-      throw error;
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  }
-  async handleErrorResponse(response) {
-    let message = "";
-    try {
-      const errorBody = await response.json();
-      message = errorBody?.error?.reason || errorBody?.message || response.statusText;
-    } catch {
-      try {
-        message = await response.text();
-      } catch {
-        message = response.statusText;
-      }
-    }
-    const status = response.status;
-    if (status === 401) {
-      throw new ConnectionError("AUTH_FAILED", `Authentication failed: ${message}`, [
-        "Check your API key or username/password",
-        "Verify if the user has required roles"
-      ]);
-    }
-    if (status === 403) {
-      throw new ConnectionError("AUTH_FAILED", `Permission denied: ${message}`, [
-        "User does not have permission to perform this action"
-      ]);
-    }
-    throw new ConnectionError("UNKNOWN", `Elasticsearch error (${status}): ${message}`, [
-      "Check Elasticsearch logs for more details",
-      "Verify the request body is valid ES DSL"
-    ]);
-  }
-}
-
-// src/utils/connection-timeout.ts
-var _globalConnectionTimeout;
-var _globalStatementTimeout;
-function resolveConnectionTimeout(configured) {
-  return _globalConnectionTimeout ?? configured;
-}
-function resolveStatementTimeout(configured) {
-  return _globalStatementTimeout ?? configured;
-}
-function withResolvedTimeout(options) {
-  const timeout = resolveConnectionTimeout(options.timeout);
-  const statementTimeout = resolveStatementTimeout(options.statementTimeout);
-  if (timeout === options.timeout && statementTimeout === options.statementTimeout)
-    return options;
-  return { ...options, timeout, statementTimeout };
-}
-
-// src/adapters/factory.ts
-class AdapterFactory {
-  static createSqlAdapter(rawOptions) {
-    const options = withResolvedTimeout(rawOptions);
-    switch (options.system) {
-      case "postgresql":
-        return new PostgreSQLAdapter(options);
-      case "mysql":
-      case "mariadb":
-        return new MySQLAdapter(options);
-      default:
-        throw new Error(`createSqlAdapter requires a SQL system, got: ${options.system}`);
-    }
-  }
-  static createQueryableAdapter(rawOptions) {
-    const options = withResolvedTimeout(rawOptions);
-    switch (options.system) {
-      case "mongodb":
-        return new MongoDBAdapter(options);
-      case "redis":
-        return new RedisAdapter(options);
-      case "elasticsearch":
-        return new ElasticsearchAdapter(options);
-      default:
-        throw new Error(`createQueryableAdapter requires a non-SQL queryable system, got: ${options.system}`);
-    }
-  }
-  static createAdapter(options) {
-    switch (options.system) {
-      case "postgresql":
-      case "mysql":
-      case "mariadb":
-        return AdapterFactory.createSqlAdapter(options);
-      case "mongodb":
-      case "redis":
-      case "elasticsearch":
-        return AdapterFactory.createQueryableAdapter(options);
-      default:
-        throw new Error(`Unsupported database system: ${options.system}`);
-    }
-  }
-  static createMongoDBAdapter(options) {
-    if (options.system !== "mongodb") {
-      throw new Error("createMongoDBAdapter requires system: mongodb");
-    }
-    return AdapterFactory.createQueryableAdapter(options);
-  }
-  static createRedisAdapter(rawOptions, blacklistRules = [], maskRules = []) {
-    if (rawOptions.system !== "redis") {
-      throw new Error("createRedisAdapter requires system: redis");
-    }
-    const options = withResolvedTimeout(rawOptions);
-    const adapter = new RedisAdapter(options);
-    adapter.setBlacklistRules(blacklistRules);
-    adapter.setMaskRules(maskRules);
-    return adapter;
-  }
-  static createElasticsearchAdapter(options) {
-    if (options.system !== "elasticsearch") {
-      throw new Error("createElasticsearchAdapter requires system: elasticsearch");
-    }
-    return AdapterFactory.createQueryableAdapter(options);
-  }
-}
 // src/utils/sql-lexical.ts
 var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
 var IDENTIFIER_START = /[A-Za-z_]|[\u0080-\uFFFF]/;
@@ -10349,10 +8117,26 @@ var MetadataSchema = exports_external.object({
   schemaLastUpdated: exports_external.string().datetime().optional(),
   schemaTableCount: exports_external.number().int().nonnegative().optional()
 }).optional().default({});
+var BLACKLIST_KEY_ALIASES = {
+  indices: "tables",
+  index: "tables",
+  fields: "columns",
+  keys: "tables"
+};
 var BlacklistConfigSchema = exports_external.object({
   tables: exports_external.array(exports_external.string()).default([]),
   columns: exports_external.record(exports_external.array(exports_external.string())).default({})
-}).optional().default({ tables: [], columns: {} });
+}).passthrough().superRefine((value, ctx) => {
+  for (const [wrong, right] of Object.entries(BLACKLIST_KEY_ALIASES)) {
+    if (wrong in value) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: [wrong],
+        message: `blacklist.${wrong} is not a setting and would be silently ignored \u2014 did you mean blacklist.${right}?`
+      });
+    }
+  }
+}).transform((value) => ({ tables: value.tables, columns: value.columns })).optional().default({ tables: [], columns: {} });
 var RedisMaskRuleSchema = exports_external.object({
   keyPattern: exports_external.string().min(1),
   fields: exports_external.array(exports_external.string()).optional()
@@ -10360,16 +8144,22 @@ var RedisMaskRuleSchema = exports_external.object({
 var RedisConfigSchema = exports_external.object({
   mask: exports_external.array(RedisMaskRuleSchema).default([])
 }).optional();
+var DEFAULT_AUDIT_ROTATION = { max_bytes: 10485760, max_entries: 1e4 };
 var AuditRotationConfigSchema = exports_external.object({
-  max_bytes: exports_external.number().int().positive().default(10485760),
-  max_entries: exports_external.number().int().positive().default(1000)
-}).optional().default({ max_bytes: 10485760, max_entries: 1000 });
+  max_bytes: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_bytes),
+  max_entries: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_entries)
+}).optional().default({ ...DEFAULT_AUDIT_ROTATION });
 var AuditConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true),
+  strict: exports_external.boolean().default(false),
   rotation: AuditRotationConfigSchema
+}).refine((audit) => !(audit.strict && !audit.enabled), {
+  message: "audit.strict requires audit.enabled: with audit off there is nothing to write, so " + "strict would refuse nothing. Enable audit, or turn strict off.",
+  path: ["strict"]
 }).optional().default({
   enabled: true,
-  rotation: { max_bytes: 10485760, max_entries: 1000 }
+  strict: false,
+  rotation: { ...DEFAULT_AUDIT_ROTATION }
 });
 var DbcliConfigSchema = exports_external.object({
   connection: ConnectionConfigSchema,
@@ -10400,12 +8190,24 @@ var ElasticsearchNamedConnectionSchema = ElasticsearchConnectionConfigSchema.ext
   envFile: exports_external.string().optional(),
   environment: EnvironmentLabelSchema
 });
-var NamedConnectionSchema = exports_external.union([
+var NamedConnectionUnion = exports_external.union([
   SqlNamedConnectionSchema,
   MongoDBNamedConnectionSchema,
   RedisNamedConnectionSchema,
   ElasticsearchNamedConnectionSchema
 ]);
+var NamedConnectionSchema = exports_external.preprocess((raw, ctx) => {
+  if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+    if ("blacklist" in raw) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["blacklist"],
+        message: "blacklist is configured once at the top level, not per connection \u2014 a blacklist here " + "would be ignored. Move it to the top-level blacklist."
+      });
+    }
+  }
+  return raw;
+}, NamedConnectionUnion);
 var DbcliConfigV2Schema = exports_external.object({
   version: exports_external.literal(2),
   default: exports_external.string().min(1),
@@ -10875,7 +8677,7 @@ function migrateV1ToV2(v1) {
     schemas: {},
     metadata: v1.metadata ?? { version: "2.0" },
     blacklist: v1.blacklist ?? { tables: [], columns: {} },
-    audit: v1.audit ?? { enabled: true, rotation: { max_bytes: 10485760, max_entries: 1000 } }
+    audit: v1.audit ?? { enabled: true, rotation: { ...DEFAULT_AUDIT_ROTATION } }
   };
 }
 function upsertConnection(config, input) {
@@ -11146,7 +8948,8 @@ var DEFAULT_CONFIG = {
   blacklist: { tables: [], columns: {} },
   audit: {
     enabled: true,
-    rotation: { max_bytes: 10485760, max_entries: 1000 }
+    strict: false,
+    rotation: { ...DEFAULT_AUDIT_ROTATION }
   }
 };
 function isEnvReference(value) {
@@ -11401,6 +9204,23 @@ DBCLI_PASSWORD=${password}
   }
 };
 // src/core/blacklist-manager.ts
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (column.slice(0, dot).toLowerCase() !== tableKey.toLowerCase())
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
 class BlacklistManager {
   config;
   state;
@@ -11409,6 +9229,7 @@ class BlacklistManager {
     this.config = config;
     this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
     this.state = this.loadBlacklist();
+    this.wildcardTables = [...this.state.tables].filter((entry) => /[*?[\\]/.test(entry));
   }
   loadBlacklist() {
     const tables = new Set;
@@ -11420,7 +9241,7 @@ class BlacklistManager {
     if (Array.isArray(blacklistConfig.tables)) {
       for (const tableName of blacklistConfig.tables) {
         if (typeof tableName === "string") {
-          tables.add(tableName.toLowerCase());
+          tables.add(normalizeBlacklistEntry(tableName).toLowerCase());
         } else {
           console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
         }
@@ -11441,13 +9262,15 @@ class BlacklistManager {
         const columnSet = new Set;
         for (const col of cols) {
           if (typeof col === "string") {
-            columnSet.add(col);
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
           } else {
             console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
           }
         }
         if (columnSet.size > 0) {
-          columns.set(tableName.toLowerCase(), columnSet);
+          columns.set(normalizeBlacklistEntry(tableName).toLowerCase(), columnSet);
         }
       }
     } else if (blacklistConfig.columns !== undefined) {
@@ -11456,17 +9279,47 @@ class BlacklistManager {
     return { tables, columns };
   }
   isTableBlacklisted(tableName) {
-    return this.state.tables.has(tableName.toLowerCase());
+    const name = tableName.toLowerCase();
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, name))
+        return true;
+    }
+    return false;
+  }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = normalizeBlacklistEntry(tableName).toLowerCase();
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
   }
   isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
+    const columnSet = this.columnRulesFor(tableName);
     if (!columnSet) {
       return false;
     }
-    return columnSet.has(columnName);
+    return columnSet.has(normalizeBlacklistEntry(columnName).toLowerCase());
   }
   getBlacklistedColumns(tableName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
+    const columnSet = this.columnRulesFor(tableName);
     if (!columnSet) {
       return [];
     }
@@ -11530,11 +9383,37 @@ function expandIndexTargets(target) {
 function matchesIndexGlob(pattern, name) {
   const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
   try {
-    return globToRegex(normalized).test(name.toLowerCase());
+    return globMatches(normalized, name.toLowerCase());
   } catch {
     return true;
   }
 }
+function reachesByConvention(name, entry) {
+  const lower = name.toLowerCase();
+  const target = entry.toLowerCase();
+  return new RegExp(`^\\.ds-${escapeRegExp(target)}-`).test(lower) || new RegExp(`^${escapeRegExp(target)}-\\d+$`).test(lower);
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function expandBlacklistEntries(blacklisted) {
+  const names = [];
+  const patterns = [];
+  for (const entry of blacklisted) {
+    const { concrete, wildcards } = expandIndexTargets(entry);
+    names.push(...concrete);
+    patterns.push(...wildcards);
+  }
+  return { names, patterns };
+}
+function indexExpressionReaches(expression, blacklisted) {
+  if (blacklisted.length === 0)
+    return false;
+  const { concrete, wildcards } = expandIndexTargets(expression);
+  const entries = expandBlacklistEntries(blacklisted);
+  const reachesName = (name) => entries.names.some((entry) => entry.toLowerCase() === name.toLowerCase() || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
+  return concrete.some(reachesName) || wildcards.some((pattern) => entries.names.some((entry) => matchesIndexGlob(pattern, entry)) || entries.patterns.length > 0);
+}
 
 // src/core/blacklist-validator.ts
 function flattenArrayRow(row) {
@@ -11559,6 +9438,17 @@ function dedupe2(values) {
   }
   return result;
 }
+function compileGlobRules(rules, fold, table, operation) {
+  const globbed = rules.filter((rule) => /[*?[\\]/.test(rule));
+  if (globbed.length === 0)
+    return [];
+  const { patterns, rejected } = compilePatterns(globbed.map(fold));
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
+  }
+  return patterns;
+}
 
 class BlacklistValidator {
   manager;
@@ -11592,26 +9482,23 @@ class BlacklistValidator {
     throw new BlacklistError(message, blocked[0], operation);
   }
   checkIndexBlacklist(operation, target) {
-    const { concrete, wildcards } = expandIndexTargets(target);
-    this.checkTablesBlacklist(operation, concrete);
-    if (wildcards.length === 0 || this.manager.canOverrideBlacklist())
+    if (this.manager.canOverrideBlacklist())
       return;
     const blacklisted = Array.from(this.manager.getState().tables);
     if (blacklisted.length === 0)
       return;
-    const reachable = wildcards.filter((pattern) => blacklisted.some((entry) => matchesIndexGlob(pattern, entry)));
-    if (reachable.length === 0)
+    if (!indexExpressionReaches(target, blacklisted))
       return;
     const message = t_vars("errors.table_blacklisted", {
-      table: reachable.join(", "),
+      table: target,
       operation
     });
-    throw new BlacklistError(message, reachable[0], operation);
+    throw new BlacklistError(message, target, operation);
   }
   filterColumnsForIndexExpression(target, rows, columnList) {
     const { concrete, wildcards } = expandIndexTargets(target);
     const ruleKeys = Array.from(this.manager.getState().columns.keys());
-    const reachable = ruleKeys.filter((key) => wildcards.some((pattern) => matchesIndexGlob(pattern, key)));
+    const reachable = ruleKeys.filter((key) => wildcards.some((pattern) => matchesIndexGlob(pattern, key)) || concrete.some((name) => indexExpressionReaches(name, [key])));
     return this.filterColumnsForTables([...concrete, ...reachable], rows, columnList);
   }
   checkColumnBlacklistOnWrite(tableName, fields, operation = "WRITE") {
@@ -11619,7 +9506,27 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const conflicts = fields.filter((f) => blacklisted.includes(f));
+    const protectedPaths = new Set(blacklisted.map((name) => name.toLowerCase()));
+    const globs = compileGlobRules(blacklisted, (value) => value.toLowerCase(), tableName, operation);
+    const conflicts = fields.filter((field) => {
+      const name = field.toLowerCase();
+      if (protectedPaths.has(name))
+        return true;
+      if (matchAny(name, globs))
+        return true;
+      let dot = name.indexOf(".");
+      while (dot >= 0) {
+        if (dot > 0) {
+          const ancestor = name.slice(0, dot);
+          if (protectedPaths.has(ancestor))
+            return true;
+          if (matchAny(ancestor, globs))
+            return true;
+        }
+        dot = name.indexOf(".", dot + 1);
+      }
+      return false;
+    });
     if (conflicts.length === 0) {
       return;
     }
@@ -11670,11 +9577,20 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const protectedPaths = new Set(blacklistedColumns);
+    const foldHead = (path) => {
+      const dot = path.indexOf(".");
+      return dot < 0 ? path.toLowerCase() : path.slice(0, dot).toLowerCase() + path.slice(dot);
+    };
+    const protectedPaths = new Set(blacklistedColumns.map(foldHead));
+    const globRules = compileGlobRules(blacklistedColumns, foldHead, tables[0] ?? "unknown", "SELECT");
+    const presentByFolded = new Map;
+    for (const column of presentColumns)
+      presentByFolded.set(foldHead(column), column);
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      if (presentColumns.has(path)) {
-        omitted.add(path);
+      const present = presentByFolded.get(foldHead(path));
+      if (present !== undefined) {
+        omitted.add(present);
         continue;
       }
       const dot = path.indexOf(".");
@@ -11689,13 +9605,30 @@ class BlacklistValidator {
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot))) {
+        if (dot > 0 && protectedPaths.has(column.slice(0, dot).toLowerCase())) {
           omitted.add(column);
           break;
         }
         dot = column.indexOf(".", dot + 1);
       }
     }
+    if (globRules.length > 0) {
+      for (const column of presentColumns) {
+        const folded = foldHead(column);
+        if (matchAny(folded, globRules)) {
+          omitted.add(column);
+          continue;
+        }
+        let dot = folded.indexOf(".");
+        while (dot >= 0) {
+          if (dot > 0 && matchAny(folded.slice(0, dot), globRules)) {
+            omitted.add(column);
+            break;
+          }
+          dot = folded.indexOf(".", dot + 1);
+        }
+      }
+    }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
@@ -11742,6 +9675,5 @@ export {
   ConnectionError,
   BlacklistValidator,
   BlacklistManager,
-  BlacklistError,
-  AdapterFactory
+  BlacklistError
 };