@carllee1983/dbcli 4.0.0 → 7.0.0

package/dist/cli-runtime.mjs

@@ -51,7 +51,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "4.0.0",
+    version: "7.0.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -183,7 +183,9 @@ var init_package = __esm(() => {
     },
     overrides: {
       "brace-expansion": "^5.0.9",
-      postcss: "^8.5.26"
+      browserslist: "^4.28.7",
+      postcss: "^8.5.26",
+      "postcss-selector-parser": "^6.1.3"
     }
   };
 });
@@ -4372,7 +4374,7 @@ function validateFormat(value, allowedFormats, commandName) {
     throw new Error(`Invalid format "${value}" for ${commandName}. Allowed: ${allowed}`);
   }
 }
-var EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
+var EnvRefSchema, StringOrEnvRef, NumberOrEnvRef, OptStringOrEnvRef, OptNumberOrEnvRef, MIN_CONNECTION_TIMEOUT_MS = 100, MAX_CONNECTION_TIMEOUT_MS = 600000, MIN_STATEMENT_TIMEOUT_MS = 0, MAX_STATEMENT_TIMEOUT_MS = 3600000, TimeoutField, MongoDBConnectionConfigSchema, SqlConnectionConfigSchema, RedisConnectionConfigSchema, ElasticsearchConnectionConfigSchema, ConnectionConfigSchema, PermissionSchema, EnvironmentLabelSchema, MetadataSchema, BLACKLIST_KEY_ALIASES, BlacklistConfigSchema, RedisMaskRuleSchema, RedisConfigSchema, DEFAULT_AUDIT_ROTATION, AuditRotationConfigSchema, AuditConfigSchema, DbcliConfigSchema, SqlNamedConnectionSchema, MongoDBNamedConnectionSchema, RedisNamedConnectionSchema, ElasticsearchNamedConnectionSchema, NamedConnectionUnion, NamedConnectionSchema, DbcliConfigV2Schema;
 var init_validation = __esm(() => {
   init_zod();
   EnvRefSchema = exports_external.object({
@@ -4474,10 +4476,11 @@ var init_validation = __esm(() => {
   RedisConfigSchema = exports_external.object({
     mask: exports_external.array(RedisMaskRuleSchema).default([])
   }).optional();
+  DEFAULT_AUDIT_ROTATION = { max_bytes: 10485760, max_entries: 1e4 };
   AuditRotationConfigSchema = exports_external.object({
-    max_bytes: exports_external.number().int().positive().default(10485760),
-    max_entries: exports_external.number().int().positive().default(1000)
-  }).optional().default({ max_bytes: 10485760, max_entries: 1000 });
+    max_bytes: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_bytes),
+    max_entries: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_entries)
+  }).optional().default({ ...DEFAULT_AUDIT_ROTATION });
   AuditConfigSchema = exports_external.object({
     enabled: exports_external.boolean().default(true),
     strict: exports_external.boolean().default(false),
@@ -4488,7 +4491,7 @@ var init_validation = __esm(() => {
   }).optional().default({
     enabled: true,
     strict: false,
-    rotation: { max_bytes: 10485760, max_entries: 1000 }
+    rotation: { ...DEFAULT_AUDIT_ROTATION }
   });
   DbcliConfigSchema = exports_external.object({
     connection: ConnectionConfigSchema,
@@ -6321,7 +6324,7 @@ var init_config = __esm(() => {
     audit: {
       enabled: true,
       strict: false,
-      rotation: { max_bytes: 10485760, max_entries: 1000 }
+      rotation: { ...DEFAULT_AUDIT_ROTATION }
     }
   };
   configModule = {
@@ -9018,6 +9021,7 @@ var init_messages = __esm(() => {
       unsupported_lang: "Language '{lang}' not supported, using English",
       invalid_json: "Invalid JSON: {message}",
       table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
+      redis_target_blacklisted: "Redis command refused by blacklist",
       column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
       table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
       table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
@@ -9109,7 +9113,8 @@ Reference: {referencePath}`,
       columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
     },
     warnings: {
-      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'"
+      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
+      redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
     },
     version: {
       unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
@@ -9336,6 +9341,7 @@ var init_messages2 = __esm(() => {
       unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
       invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
       table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
+      redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
       column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
       table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
       table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
@@ -9427,7 +9433,8 @@ var init_messages2 = __esm(() => {
       columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
     },
     warnings: {
-      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A"
+      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
+      redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
     },
     version: {
       unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
@@ -11164,31 +11171,349 @@ var init_server_side_script = __esm(() => {
   ES_OPAQUE_BODY_KEYS = ["wrapper"];
 });
 
-// src/core/mongo/request-fields.ts
-function asFieldPath(text2) {
-  if (text2.startsWith("$$"))
-    return text2.slice(2);
-  if (text2.startsWith("$"))
-    return text2.slice(1);
-  return text2;
+// src/utils/case-fold.ts
+function foldCase(text2) {
+  const lowered = (text2.includes("\u0130") ? text2.replaceAll("\u0130", "i") : text2).toLowerCase();
+  return lowered.includes("\u03C2") ? lowered.replaceAll("\u03C2", "\u03C3") : lowered;
+}
+
+// src/utils/glob.ts
+function findClassEnd(glob, open2) {
+  for (let i = open2 + 1;i < glob.length; i++) {
+    if (glob[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (glob[i] === "]")
+      return i;
+  }
+  return -1;
 }
-function reachesProtectedField(path, protectedFields) {
-  if (protectedFields.has(path))
+function isValidCharacterClass(body) {
+  try {
+    new RegExp(body);
     return true;
-  const parts = path.split(".");
-  if (parts.length === 1)
+  } catch {
     return false;
-  for (let start = 0;start < parts.length; start += 1) {
-    for (let end = start + 1;end <= parts.length; end += 1) {
-      if (protectedFields.has(parts.slice(start, end).join(".")))
+  }
+}
+function parseGlob(glob, caseInsensitive) {
+  const key = `${caseInsensitive ? "i" : "c"}\x00${glob}`;
+  const memo = parsedGlobs.get(key);
+  if (memo !== undefined)
+    return memo;
+  const parsed = parseGlobUncached(glob, caseInsensitive);
+  if (parsedGlobs.size >= PARSED_GLOB_LIMIT)
+    parsedGlobs.clear();
+  parsedGlobs.set(key, parsed);
+  return parsed;
+}
+function parseGlobUncached(glob, caseInsensitive) {
+  const runs = [];
+  let current = [];
+  let leadingStar = false;
+  let trailingStar = false;
+  let sawStar = false;
+  const endRun = () => {
+    if (current.length > 0)
+      runs.push(current);
+    current = [];
+  };
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      trailingStar = false;
+      const escaped = String.fromCodePoint(glob.codePointAt(++i));
+      i += escaped.length - 1;
+      current.push(...literalToken(escaped, caseInsensitive));
+      continue;
+    }
+    if (c === "*") {
+      if (!sawStar && current.length === 0)
+        leadingStar = true;
+      sawStar = true;
+      trailingStar = true;
+      endRun();
+      continue;
+    }
+    trailingStar = false;
+    if (c === "?") {
+      current.push({ kind: "any" });
+      continue;
+    }
+    if (c === "[") {
+      const end = findClassEnd(glob, i);
+      const body = end === -1 ? "" : glob.slice(i, end + 1);
+      if (body !== "" && isValidCharacterClass(body)) {
+        current.push({
+          kind: "class",
+          test: new RegExp(`^${body}$`, caseInsensitive ? "si" : "s")
+        });
+        i = end;
+        continue;
+      }
+      current.push(...literalToken("[", caseInsensitive));
+      continue;
+    }
+    const literal = String.fromCodePoint(glob.codePointAt(i));
+    i += literal.length - 1;
+    current.push(...literalToken(literal, caseInsensitive));
+  }
+  endRun();
+  return { runs, leadingStar, trailingStar, anchored: !sawStar };
+}
+function literalToken(codePoint, caseInsensitive) {
+  const folded = caseInsensitive ? foldCase(codePoint) : codePoint;
+  return folded.split("").map((unit) => ({ kind: "literal", char: unit }));
+}
+function runMatchesAt(run, text2, raw, at) {
+  if (at + run.length > text2.length)
+    return false;
+  for (let i = 0;i < run.length; i++) {
+    const token = run[i];
+    if (token.kind === "literal") {
+      if (token.char !== text2[at + i])
+        return false;
+    } else if (token.kind === "class") {
+      const rawChar = raw[at + i];
+      if (rawChar === undefined) {
+        throw new Error("globMatches: folded and unfolded subject lengths disagree");
+      }
+      if (!token.test.test(rawChar))
+        return false;
+    }
+  }
+  return true;
+}
+function globMatches(glob, subject, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob, caseInsensitive);
+  const text2 = caseInsensitive ? foldCase(subject) : subject;
+  if (anchored) {
+    const run = runs[0] ?? [];
+    return text2.length === run.length && runMatchesAt(run, text2, subject, 0);
+  }
+  if (runs.length === 0)
+    return true;
+  let cursor = 0;
+  let first = 0;
+  let last = runs.length;
+  if (!leadingStar) {
+    const head = runs[0];
+    if (!runMatchesAt(head, text2, subject, 0))
+      return false;
+    cursor = head.length;
+    first = 1;
+  }
+  if (!trailingStar) {
+    const tail = runs[last - 1];
+    const at = text2.length - tail.length;
+    if (at < cursor || !runMatchesAt(tail, text2, subject, at))
+      return false;
+    last -= 1;
+  }
+  const limit = trailingStar ? text2.length : text2.length - runs[runs.length - 1].length;
+  for (let r = first;r < last; r++) {
+    const run = runs[r];
+    let found = -1;
+    for (let at = cursor;at + run.length <= limit; at++) {
+      if (runMatchesAt(run, text2, subject, at)) {
+        found = at;
+        break;
+      }
+    }
+    if (found === -1)
+      return false;
+    cursor = found + run.length;
+  }
+  return true;
+}
+function isGlobPattern(value) {
+  return /[*?[\\]/.test(value);
+}
+function escapeGlob(literal) {
+  return literal.replace(/[*?[\]\\]/g, "\\$&");
+}
+function globNeverMatches(glob) {
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c !== "[")
+      continue;
+    const end = findClassEnd(glob, i);
+    if (end === -1) {
+      return "unclosed character class";
+    }
+    const body = glob.slice(i, end + 1);
+    if (body === "[]" || body === "[^]")
+      return "empty character class matches nothing";
+    if (!isValidCharacterClass(body))
+      return "invalid character class";
+    i = end;
+  }
+  return null;
+}
+var parsedGlobs, PARSED_GLOB_LIMIT = 4096;
+var init_glob = __esm(() => {
+  parsedGlobs = new Map;
+});
+
+// src/core/blacklist-fold.ts
+function foldFieldPath(path) {
+  return foldCase(path);
+}
+var init_blacklist_fold = () => {};
+
+// src/core/mongo/path-matcher.ts
+function compilePatterns(raw) {
+  const patterns = [];
+  const rejected = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      rejected.push({ raw: String(entry ?? ""), reason: "must be a non-empty string" });
+      continue;
+    }
+    const segments = entry.split(".");
+    if (segments.some((s) => s.length === 0)) {
+      rejected.push({ raw: entry, reason: "empty path segment" });
+      continue;
+    }
+    const globstar = segments.find((seg) => seg.includes("**"));
+    if (globstar !== undefined) {
+      rejected.push({
+        raw: entry,
+        reason: "`**` matches one segment, not a subtree; write `*` or a longer path"
+      });
+      continue;
+    }
+    const dead = segments.map((seg) => globNeverMatches(seg)).find((r) => r !== null);
+    if (dead !== undefined && dead !== null) {
+      rejected.push({ raw: entry, reason: dead });
+      continue;
+    }
+    const wildcardTail = segments.length > 1 && segments[segments.length - 1] === "*";
+    const literal = wildcardTail ? segments.slice(0, -1) : segments;
+    patterns.push({
+      raw: entry,
+      segments: literal,
+      wildcardTail
+    });
+  }
+  return { patterns, rejected };
+}
+function matchSegment(pattern, segment) {
+  return globMatches(pattern, segment, FOLD_CASE);
+}
+function matchAny(path, patterns) {
+  if (patterns.length === 0)
+    return false;
+  const pathSegments = path.split(".");
+  for (const pat of patterns) {
+    if (pat.wildcardTail) {
+      if (pathSegments.length < pat.segments.length)
+        continue;
+    } else {
+      if (pat.segments.length !== pathSegments.length)
+        continue;
+    }
+    let ok = true;
+    for (let i = 0;i < pat.segments.length; i++) {
+      if (!globMatches(pat.segments[i], pathSegments[i], FOLD_CASE)) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok)
+      return true;
+  }
+  return false;
+}
+function contiguousRules(literals, globs) {
+  const widths = new Set;
+  for (const rule of literals)
+    widths.add(rule.split(".").length);
+  return { literals, globs, literalWidths: [...widths].sort((a, b) => a - b) };
+}
+function reachesProtectedSegments(segments, rules) {
+  const { literals, globs, literalWidths } = rules;
+  const depth = segments.length;
+  for (let start = 0;start < depth; start++) {
+    for (const width of literalWidths) {
+      const end = start + width;
+      if (end > depth)
+        break;
+      const candidate = width === 1 ? segments[start] : segments.slice(start, end).join(".");
+      if (literals.has(candidate))
+        return true;
+    }
+    for (const pattern of globs) {
+      const width = pattern.segments.length;
+      if (start + width > depth)
+        continue;
+      let matched = true;
+      for (let i = 0;i < width; i++) {
+        if (!matchSegment(pattern.segments[i], segments[start + i])) {
+          matched = false;
+          break;
+        }
+      }
+      if (matched)
         return true;
     }
   }
   return false;
 }
+function reachesProtectedPath(path, rules) {
+  return reachesProtectedSegments(path.split("."), rules);
+}
+function contiguousRulesFor(protectedFields) {
+  const memo = compiledRuleSets.get(protectedFields);
+  if (memo !== undefined)
+    return memo;
+  const globbed = [];
+  const literals = new Set;
+  for (const rule of protectedFields) {
+    if (isGlobPattern(rule))
+      globbed.push(rule);
+    else
+      literals.add(foldFieldPath(rule));
+  }
+  let globs = [];
+  if (globbed.length > 0) {
+    const compiled = compilePatterns(globbed);
+    if (compiled.rejected.length > 0) {
+      const detail = compiled.rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+      throw new Error(`BlacklistRejection: blacklist entries this matcher cannot read: ${detail}`);
+    }
+    globs = compiled.patterns;
+  }
+  const rules = contiguousRules(literals, globs);
+  compiledRuleSets.set(protectedFields, rules);
+  return rules;
+}
+var FOLD_CASE, compiledRuleSets;
+var init_path_matcher = __esm(() => {
+  init_glob();
+  init_blacklist_fold();
+  FOLD_CASE = { caseInsensitive: true };
+  compiledRuleSets = new WeakMap;
+});
+
+// src/core/mongo/request-fields.ts
+function asFieldPath(text2) {
+  if (text2.startsWith("$$"))
+    return text2.slice(2);
+  if (text2.startsWith("$"))
+    return text2.slice(1);
+  return text2;
+}
 function findProtectedFieldReference(request, protectedFields) {
   if (protectedFields.size === 0)
     return;
+  const rules = contiguousRulesFor(protectedFields);
   const candidates = [];
   let movesWholeDocument = false;
   const walk = (node) => {
@@ -11222,7 +11547,7 @@ function findProtectedFieldReference(request, protectedFields) {
     }
   };
   walk(request);
-  const named = candidates.find((path) => path.length > 0 && reachesProtectedField(path, protectedFields));
+  const named = candidates.find((path) => path.length > 0 && reachesProtectedPath(foldFieldPath(path), rules));
   if (named !== undefined)
     return named;
   return movesWholeDocument ? [...protectedFields][0] : undefined;
@@ -11245,10 +11570,12 @@ function protectedFieldsForRequest(request, collection, columns) {
       collectStrings(value);
   };
   collectStrings(request);
-  const namedLower = new Set([...named].map((value) => value.toLowerCase()));
+  const namedFolded = new Set([...named].map(foldFieldPath));
+  const collectionFolded = foldFieldPath(collection);
   const fields = new Set;
   for (const [name, rules] of Object.entries(columns)) {
-    const applies = name.toLowerCase() === collection.toLowerCase() || namedLower.has(name.toLowerCase());
+    const folded = foldFieldPath(name);
+    const applies = folded === collectionFolded || namedFolded.has(folded);
     if (!applies)
       continue;
     for (const rule of rules) {
@@ -11261,6 +11588,8 @@ function protectedFieldsForRequest(request, collection, columns) {
 }
 var WHOLE_DOCUMENT_VARIABLES, RESHAPES_DOCUMENT, NAMES_A_FIELD_DYNAMICALLY = "$getField";
 var init_request_fields = __esm(() => {
+  init_path_matcher();
+  init_blacklist_fold();
   WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
   RESHAPES_DOCUMENT = new Set(["$objectToArray", "$replaceRoot", "$replaceWith"]);
 });
@@ -12215,66 +12544,13 @@ var init_size_guard = __esm(() => {
   init_types3();
 });
 
-// src/utils/glob.ts
-function globToRegex(glob) {
-  let out = "^";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "\\" && i + 1 < glob.length) {
-      out += glob[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      continue;
-    }
-    if (c === "*")
-      out += ".*";
-    else if (c === "?")
-      out += ".";
-    else if (c === "[") {
-      const end = findClassEnd(glob, i);
-      const body = end === -1 ? "" : glob.slice(i, end + 1);
-      if (body !== "" && isValidCharacterClass(body)) {
-        out += body;
-        i = end;
-      } else {
-        out += "\\[";
-      }
-    } else if (".^$+(){}|\\".includes(c)) {
-      out += "\\" + c;
-    } else {
-      out += c;
-    }
-  }
-  out += "$";
-  return new RegExp(out);
-}
-function findClassEnd(glob, open2) {
-  for (let i = open2 + 1;i < glob.length; i++) {
-    if (glob[i] === "\\") {
-      i++;
-      continue;
-    }
-    if (glob[i] === "]")
-      return i;
-  }
-  return -1;
-}
-function isValidCharacterClass(body) {
-  try {
-    new RegExp(body);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // src/adapters/redis/blacklist-enforcer.ts
 function patternsOverlap(a, b) {
-  const ra = globToRegex(a);
-  const rb = globToRegex(b);
   const probeA = sampleFromGlob(a);
   const probeB = sampleFromGlob(b);
-  if (probeA !== null && rb.test(probeA))
+  if (probeA !== null && globMatches(b, probeA))
     return true;
-  if (probeB !== null && ra.test(probeB))
+  if (probeB !== null && globMatches(a, probeB))
     return true;
   return false;
 }
@@ -12300,6 +12576,15 @@ function sampleFromGlob(glob) {
   }
   return s;
 }
+function redisCommandTargets(command, args) {
+  const spec = getCommandSpec(command);
+  if (!spec)
+    return [];
+  return [
+    ...expandKeyArity(spec.keyArity, args, args.length).map((index) => args[index]).filter((key) => key !== undefined),
+    ...userPatterns(spec.keyArity, args)
+  ];
+}
 function checkKeyArgs(command, args, rules) {
   if (rules.length === 0)
     return { ok: true };
@@ -12317,7 +12602,7 @@ function checkKeyArgs(command, args, rules) {
     if (key === undefined)
       continue;
     for (const pat of rules) {
-      if (globToRegex(pat).test(key)) {
+      if (globMatches(pat, key)) {
         return { ok: false, matchedKey: key, matchedPattern: pat };
       }
     }
@@ -12374,6 +12659,7 @@ function expandKeyArity(arity, args, argCount) {
 }
 var init_blacklist_enforcer = __esm(() => {
   init_command_metadata();
+  init_glob();
 });
 
 // src/adapters/redis/returned-key-names.ts
@@ -12385,8 +12671,7 @@ function filterReturnedKeyNames(command, reply, rules) {
     return reply;
   if (!returnsKeyNames(command))
     return reply;
-  const regexes = rules.map((pattern) => globToRegex(pattern));
-  const permitted = (key) => typeof key === "string" && regexes.every((regex) => !regex.test(key));
+  const permitted = (key) => typeof key === "string" && rules.every((rule) => !globMatches(rule, key));
   if (Array.isArray(reply) && reply.length === 2 && Array.isArray(reply[1])) {
     return [reply[0], reply[1].filter(permitted)];
   }
@@ -12396,12 +12681,13 @@ function filterReturnedKeyNames(command, reply, rules) {
 }
 var RETURNS_KEY_NAMES;
 var init_returned_key_names = __esm(() => {
+  init_glob();
   RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
 });
 
 // src/adapters/redis/value-masker.ts
 function planFor(key, rules) {
-  const matched = rules.filter((r) => globToRegex(r.keyPattern).test(key));
+  const matched = rules.filter((r) => globMatches(r.keyPattern, key));
   if (matched.length === 0)
     return null;
   const wholeValue = matched.some((r) => !r.fields || r.fields.length === 0);
@@ -12456,7 +12742,7 @@ function maskRedisRows(command, args, rows, rules) {
 }
 var REDACTED = "[REDACTED]", MASKABLE;
 var init_value_masker = __esm(() => {
-  init_blacklist_enforcer();
+  init_glob();
   MASKABLE = new Set(["GET", "GETRANGE", "HGETALL", "HGET", "HMGET", "HVALS"]);
 });
 
@@ -12547,8 +12833,7 @@ class RedisAdapter {
   async sampleKeyNames(limit) {
     const client = this.requireClient();
     const rules = this.blacklistRules;
-    const regexes = rules.map((p) => globToRegex(p));
-    const { keys, scanned } = await scanAllKeys(client, "*", limit, limit, (key) => regexes.every((r) => !r.test(key)));
+    const { keys, scanned } = await scanAllKeys(client, "*", limit, limit, (key) => rules.every((rule) => !globMatches(rule, key)));
     return { names: keys, truncated: scanned >= limit };
   }
   async getDbSize() {
@@ -12927,6 +13212,7 @@ var init_redis_adapter = __esm(() => {
   init_types2();
   init_size_guard();
   init_blacklist_enforcer();
+  init_glob();
   init_returned_key_names();
   init_types3();
   init_command_metadata();
@@ -13227,6 +13513,180 @@ var init_elasticsearch_adapter = __esm(() => {
   init_server_side_script();
 });
 
+// src/core/blacklist-manager.ts
+function isBlacklistOverrideEnabled(value) {
+  return (value ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
+}
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (foldFieldPath(column.slice(0, dot)) !== foldFieldPath(tableKey))
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
+class BlacklistManager {
+  config;
+  state;
+  overrideEnabled;
+  rawTables = [];
+  constructor(config, overrideEnvValue) {
+    this.config = config;
+    this.overrideEnabled = isBlacklistOverrideEnabled(overrideEnvValue);
+    this.state = this.loadBlacklist();
+    this.wildcardTables = this.rawTables.filter(isGlobPattern);
+  }
+  loadBlacklist() {
+    this.rawTables.length = 0;
+    const tables = new Set;
+    const columns = new Map;
+    const blacklistConfig = this.config.blacklist;
+    if (!blacklistConfig) {
+      return { tables, columns };
+    }
+    if (Array.isArray(blacklistConfig.tables)) {
+      for (const tableName of blacklistConfig.tables) {
+        if (typeof tableName === "string") {
+          const entry = normalizeBlacklistEntry(tableName);
+          this.rawTables.push(entry);
+          tables.add(foldFieldPath(entry));
+        } else {
+          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
+        }
+      }
+    } else if (blacklistConfig.tables !== undefined) {
+      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
+    }
+    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
+      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
+        if (typeof tableName !== "string") {
+          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
+          continue;
+        }
+        if (!Array.isArray(cols)) {
+          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
+          continue;
+        }
+        const columnSet = new Set;
+        for (const col of cols) {
+          if (typeof col === "string") {
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
+          } else {
+            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
+          }
+        }
+        if (columnSet.size > 0) {
+          columns.set(foldFieldPath(normalizeBlacklistEntry(tableName)), columnSet);
+        }
+      }
+    } else if (blacklistConfig.columns !== undefined) {
+      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
+    }
+    return { tables, columns };
+  }
+  isTableBlacklisted(tableName) {
+    const name = foldFieldPath(tableName);
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, tableName, { caseInsensitive: true }))
+        return true;
+    }
+    return false;
+  }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = foldFieldPath(normalizeBlacklistEntry(tableName));
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
+  }
+  isColumnBlacklisted(tableName, columnName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return false;
+    }
+    const target = foldFieldPath(normalizeBlacklistEntry(columnName));
+    const compiled = this.foldedColumnsFor(columnSet);
+    if (compiled.literals.has(target))
+      return true;
+    return compiled.globs.length > 0 && matchAny(target, compiled.globs);
+  }
+  foldedColumns = new WeakMap;
+  foldedColumnsFor(columnSet) {
+    const memo = this.foldedColumns.get(columnSet);
+    if (memo !== undefined)
+      return memo;
+    const literals = new Set;
+    const globbed = [];
+    for (const rule of columnSet) {
+      if (isGlobPattern(rule))
+        globbed.push(rule);
+      else
+        literals.add(foldFieldPath(rule));
+    }
+    const folded = {
+      literals,
+      globs: globbed.length > 0 ? compilePatterns(globbed).patterns : []
+    };
+    this.foldedColumns.set(columnSet, folded);
+    return folded;
+  }
+  getBlacklistedColumns(tableName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return [];
+    }
+    return Array.from(columnSet);
+  }
+  getAllBlacklistedColumns() {
+    const all = new Set;
+    for (const columnSet of this.state.columns.values()) {
+      for (const column of columnSet)
+        all.add(column);
+    }
+    return Array.from(all);
+  }
+  canOverrideBlacklist() {
+    return this.overrideEnabled;
+  }
+  getState() {
+    return this.state;
+  }
+}
+var init_blacklist_manager = __esm(() => {
+  init_glob();
+  init_blacklist_fold();
+  init_path_matcher();
+});
+
 // src/adapters/factory.ts
 class AdapterFactory {
   static createSqlAdapter(rawOptions) {
@@ -13241,7 +13701,7 @@ class AdapterFactory {
         throw new Error(`createSqlAdapter requires a SQL system, got: ${options.system}`);
     }
   }
-  static createQueryableAdapter(rawOptions) {
+  static createQueryableAdapterWithoutRules(rawOptions) {
     const options = withResolvedTimeout(rawOptions);
     switch (options.system) {
       case "mongodb":
@@ -13251,10 +13711,27 @@ class AdapterFactory {
       case "elasticsearch":
         return new ElasticsearchAdapter(options);
       default:
-        throw new Error(`createQueryableAdapter requires a non-SQL queryable system, got: ${options.system}`);
+        throw new Error(`createQueryableAdapterWithoutRules requires a non-SQL queryable system, got: ${options.system}`);
     }
   }
-  static createAdapter(options) {
+  static createAdapter(config) {
+    const options = config.connection;
+    switch (options.system) {
+      case "postgresql":
+      case "mysql":
+      case "mariadb":
+        return AdapterFactory.createSqlAdapter(options);
+      case "redis":
+        return AdapterFactory.createRedisAdapter(config);
+      case "mongodb":
+        return AdapterFactory.createMongoDBAdapter(config);
+      case "elasticsearch":
+        return AdapterFactory.createElasticsearchAdapter(options);
+      default:
+        throw new Error(`Unsupported database system: ${options.system}`);
+    }
+  }
+  static createAdapterWithoutRules(options) {
     switch (options.system) {
       case "postgresql":
       case "mysql":
@@ -13263,7 +13740,7 @@ class AdapterFactory {
       case "mongodb":
       case "redis":
       case "elasticsearch":
-        return AdapterFactory.createQueryableAdapter(options);
+        return AdapterFactory.createQueryableAdapterWithoutRules(options);
       default:
         throw new Error(`Unsupported database system: ${options.system}`);
     }
@@ -13273,7 +13750,7 @@ class AdapterFactory {
     if (options.system !== "mongodb") {
       throw new Error("createMongoDBAdapter requires system: mongodb");
     }
-    const adapter = AdapterFactory.createQueryableAdapter(options);
+    const adapter = AdapterFactory.createQueryableAdapterWithoutRules(options);
     adapter.setBlacklistColumns(config.blacklist?.columns ?? {});
     return adapter;
   }
@@ -13284,7 +13761,12 @@ class AdapterFactory {
     }
     const options = withResolvedTimeout(rawOptions);
     const adapter = new RedisAdapter(options);
-    adapter.setBlacklistRules(config.blacklist?.tables ?? []);
+    const blacklistRules = config.blacklist?.tables ?? [];
+    const overrideEnabled = isBlacklistOverrideEnabled();
+    if (overrideEnabled && blacklistRules.length > 0) {
+      console.error(t("warnings.redis_blacklist_override_active"));
+    }
+    adapter.setBlacklistRules(overrideEnabled ? [] : blacklistRules);
     adapter.setMaskRules(config.redis?.mask ?? []);
     return adapter;
   }
@@ -13292,7 +13774,7 @@ class AdapterFactory {
     if (options.system !== "elasticsearch") {
       throw new Error("createElasticsearchAdapter requires system: elasticsearch");
     }
-    return AdapterFactory.createQueryableAdapter(options);
+    return AdapterFactory.createQueryableAdapterWithoutRules(options);
   }
 }
 var init_factory = __esm(() => {
@@ -13301,6 +13783,8 @@ var init_factory = __esm(() => {
   init_mongodb_adapter();
   init_redis_adapter();
   init_elasticsearch_adapter();
+  init_blacklist_manager();
+  init_message_loader();
 });
 
 // src/adapters/index.ts
@@ -13449,7 +13933,7 @@ async function writeV2InitConfig(configPath, connectionName, connection, permiss
     audit: {
       enabled: true,
       strict: false,
-      rotation: { max_bytes: 10485760, max_entries: 1000 }
+      rotation: { ...DEFAULT_AUDIT_ROTATION }
     }
   };
   await writeV2Config(storagePath, v2Config);
@@ -13464,6 +13948,7 @@ var init_init_shared = __esm(() => {
   init_config();
   init_config_v2();
   init_prompts();
+  init_validation();
   init_config_binding();
 });
 
@@ -13914,7 +14399,7 @@ async function initCommandHandler(options, command) {
       password: String(resolveValue(newConfig.connection.password, "password")) || "",
       database: String(resolveValue(newConfig.connection.database, "database"))
     };
-    const adapter = AdapterFactory.createAdapter(testConnection);
+    const adapter = AdapterFactory.createAdapterWithoutRules(testConnection);
     try {
       await adapter.connect();
       const isHealthy = await adapter.testConnection();
@@ -16456,94 +16941,6 @@ class ColumnIndexBuilder {
     };
   }
 }
-// src/core/blacklist-manager.ts
-class BlacklistManager {
-  config;
-  state;
-  overrideEnabled;
-  constructor(config, overrideEnvValue) {
-    this.config = config;
-    this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
-    this.state = this.loadBlacklist();
-  }
-  loadBlacklist() {
-    const tables = new Set;
-    const columns = new Map;
-    const blacklistConfig = this.config.blacklist;
-    if (!blacklistConfig) {
-      return { tables, columns };
-    }
-    if (Array.isArray(blacklistConfig.tables)) {
-      for (const tableName of blacklistConfig.tables) {
-        if (typeof tableName === "string") {
-          tables.add(tableName.toLowerCase());
-        } else {
-          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
-        }
-      }
-    } else if (blacklistConfig.tables !== undefined) {
-      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
-    }
-    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
-      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
-        if (typeof tableName !== "string") {
-          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
-          continue;
-        }
-        if (!Array.isArray(cols)) {
-          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
-          continue;
-        }
-        const columnSet = new Set;
-        for (const col of cols) {
-          if (typeof col === "string") {
-            columnSet.add(col);
-          } else {
-            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
-          }
-        }
-        if (columnSet.size > 0) {
-          columns.set(tableName.toLowerCase(), columnSet);
-        }
-      }
-    } else if (blacklistConfig.columns !== undefined) {
-      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
-    }
-    return { tables, columns };
-  }
-  isTableBlacklisted(tableName) {
-    return this.state.tables.has(tableName.toLowerCase());
-  }
-  isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
-    if (!columnSet) {
-      return false;
-    }
-    return columnSet.has(columnName);
-  }
-  getBlacklistedColumns(tableName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
-    if (!columnSet) {
-      return [];
-    }
-    return Array.from(columnSet);
-  }
-  getAllBlacklistedColumns() {
-    const all = new Set;
-    for (const columnSet of this.state.columns.values()) {
-      for (const column of columnSet)
-        all.add(column);
-    }
-    return Array.from(all);
-  }
-  canOverrideBlacklist() {
-    return this.overrideEnabled;
-  }
-  getState() {
-    return this.state;
-  }
-}
-
 // src/types/blacklist.ts
 var BlacklistError;
 var init_blacklist = __esm(() => {
@@ -16607,18 +17004,138 @@ function projectRows(rows, selection) {
   const columnNames = collectColumnNames(projectedRows);
   return { rows: normalizeRows(projectedRows, columnNames), columnNames };
 }
-function hasFieldPath(row, segments) {
-  return readPath(row, segments).found;
+function hasFieldPath(row, segments, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const folded = caseInsensitive && options?.alreadyFolded !== true ? segments.map(foldCase) : segments;
+  return readPath(row, folded, caseInsensitive).found;
+}
+function narrow(rules, key) {
+  const parts = key.includes(".") ? key.split(".") : [key];
+  const live = [];
+  for (const rule of rules) {
+    const remaining = rule.segments.length;
+    if (remaining < parts.length && !rule.wildcardTail)
+      continue;
+    let matches = true;
+    for (let i = 0;i < Math.min(remaining, parts.length); i++) {
+      if (!matchSegment(rule.segments[i], parts[i])) {
+        matches = false;
+        break;
+      }
+    }
+    if (!matches)
+      continue;
+    if (remaining <= parts.length)
+      return { drop: true, live: [] };
+    live.push({
+      root: rule.root,
+      rootIndex: rule.rootIndex,
+      offset: rule.offset + parts.length,
+      segments: rule.segments.slice(parts.length),
+      wildcardTail: rule.wildcardTail
+    });
+  }
+  return { drop: false, live };
+}
+function liveRulesOf(patterns) {
+  return patterns.map((pattern, index) => ({
+    root: pattern,
+    rootIndex: index,
+    offset: 0,
+    segments: pattern.segments,
+    wildcardTail: pattern.wildcardTail
+  }));
+}
+
+class NarrowStates {
+  states = [];
+  ids = new Map;
+  transitions = new Map;
+  constructor(rules) {
+    this.intern(rules);
+  }
+  rules(state) {
+    const rules = this.states[state];
+    if (rules === undefined)
+      throw new Error(`unknown nested-rule state ${state}`);
+    return rules;
+  }
+  step(state, key) {
+    const memoKey = `${state}\x00${key}`;
+    const memo = this.transitions.get(memoKey);
+    if (memo !== undefined)
+      return memo;
+    const { drop, live } = narrow(this.rules(state), key);
+    const step = drop ? { drop: true } : { drop: false, next: this.intern(live) };
+    if (this.transitions.size >= NARROW_STATE_LIMIT)
+      this.transitions = new Map;
+    this.transitions.set(memoKey, step);
+    return step;
+  }
+  intern(rules) {
+    const key = rules.map((rule) => `${rule.rootIndex}:${rule.offset}`).join(",");
+    const existing = this.ids.get(key);
+    if (existing !== undefined)
+      return existing;
+    const id = this.states.length;
+    this.states.push(rules);
+    this.ids.set(key, id);
+    return id;
+  }
 }
-function omitFieldPaths(rows, paths) {
-  const topLevel = new Set(paths);
-  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: path.slice(0, path.indexOf(".")), segments: path.split(".") }));
+function collectNestedMatches(row, states, pending, onMatch) {
+  if (pending.size === 0)
+    return;
+  const walk = (value, state, depth) => {
+    if (pending.size === 0 || states.rules(state).length === 0)
+      return;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        walk(item, state, depth);
+      return;
+    }
+    if (!isPlainRecord(value))
+      return;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const step = states.step(state, key);
+      if (step.drop) {
+        if (depth > 0) {
+          for (const rule of states.rules(state)) {
+            if (!pending.has(rule.root))
+              continue;
+            if (!narrow([rule], key).drop)
+              continue;
+            pending.delete(rule.root);
+            onMatch(rule.root);
+          }
+        }
+        continue;
+      }
+      walk(value[key], step.next, depth + 1);
+    }
+  };
+  walk(row, 0, 0);
+}
+function compileNestedRules(patterns) {
+  return new NarrowStates(liveRulesOf(patterns));
+}
+function omitFieldPaths(rows, paths, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const nestedPatterns = options?.patterns ?? [];
+  const nestedStates = nestedPatterns.length > 0 ? compileNestedRules(nestedPatterns) : undefined;
+  const fold = (value) => caseInsensitive ? foldCase(value) : value;
+  const topLevel = new Set(paths.map(fold));
+  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: fold(path.slice(0, path.indexOf("."))), segments: path.split(".") }));
   const maskRecord = (row) => {
-    let projected = cloneRecord(row, topLevel);
+    let projected = cloneRecord(row, topLevel, caseInsensitive);
     for (const { head, segments } of dotted) {
-      const value = row[head];
-      if (value !== null && typeof value === "object")
-        projected = omitPath(projected, segments);
+      const value = headValue(row, head, caseInsensitive);
+      if (value !== null && typeof value === "object") {
+        projected = omitPath(projected, segments, caseInsensitive);
+      }
+    }
+    if (nestedStates !== undefined && hasNestedRecord(row)) {
+      projected = omitMatching(projected, nestedStates, 0);
     }
     return projected;
   };
@@ -16657,11 +17174,37 @@ function validatePath(path) {
   if (unsafe)
     throw new Error(`--fields contains an unsafe field segment: ${unsafe}`);
 }
-function readPath(value, segments) {
+function headValue(row, head, caseInsensitive) {
+  if (!caseInsensitive)
+    return row[head];
+  const key = foldedKeys(row).get(head);
+  return key === undefined ? undefined : row[key];
+}
+function foldedKeys(value) {
+  const memo = foldedKeyIndex.get(value);
+  if (memo !== undefined)
+    return memo;
+  const index = new Map;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    const folded = foldCase(key);
+    if (!index.has(folded))
+      index.set(folded, key);
+  }
+  foldedKeyIndex.set(value, index);
+  return index;
+}
+function ownKey(value, name, caseInsensitive) {
+  if (Object.prototype.hasOwnProperty.call(value, name))
+    return name;
+  if (!caseInsensitive)
+    return;
+  return foldedKeys(value).get(name);
+}
+function readPath(value, segments, caseInsensitive = false) {
   if (segments.length === 0)
     return { found: true, value };
   if (Array.isArray(value)) {
-    const results = value.map((item) => readPath(item, segments));
+    const results = value.map((item) => readPath(item, segments, caseInsensitive));
     return {
       found: results.some((result) => result.found),
       value: results.map((result) => result.found ? result.value : undefined)
@@ -16669,41 +17212,68 @@ function readPath(value, segments) {
   }
   if (!isRecord(value))
     return { found: false };
-  const exactPath = segments.join(".");
-  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
-    return { found: true, value: value[exactPath] };
-  }
+  const exact = ownKey(value, segments.join("."), caseInsensitive);
+  if (exact !== undefined)
+    return { found: true, value: value[exact] };
   const [head, ...tail] = segments;
-  if (!Object.prototype.hasOwnProperty.call(value, head))
+  const headKey = ownKey(value, head, caseInsensitive);
+  if (headKey === undefined)
     return { found: false };
-  return readPath(value[head], tail);
+  return readPath(value[headKey], tail, caseInsensitive);
+}
+function omitMatching(value, states, state) {
+  if (states.rules(state).length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitMatching(item, states, state));
+  if (!isPlainRecord(value))
+    return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const step = states.step(state, key);
+    if (step.drop)
+      continue;
+    defineData(out, key, omitMatching(child, states, step.next));
+  }
+  return out;
+}
+function hasNestedRecord(row) {
+  for (const key of Object.getOwnPropertyNames(row)) {
+    const value = row[key];
+    if (Array.isArray(value) || isPlainRecord(value))
+      return true;
+  }
+  return false;
 }
-function omitPath(value, segments) {
+function omitPath(value, segments, caseInsensitive) {
   if (segments.length === 0)
     return value;
   if (Array.isArray(value))
-    return value.map((item) => omitPath(item, segments));
+    return value.map((item) => omitPath(item, segments, caseInsensitive));
   if (!isPlainRecord(value))
     return value;
-  const exactPath = segments.join(".");
-  const [head, ...tail] = segments;
+  const fold = (name) => caseInsensitive ? foldCase(name) : name;
+  const exactPath = fold(segments.join("."));
+  const head = fold(segments[0]);
+  const tail = segments.slice(1);
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (key === exactPath)
+    const folded = fold(key);
+    if (folded === exactPath)
       continue;
-    if (key === head) {
+    if (folded === head) {
       if (tail.length > 0)
-        defineData(out, key, omitPath(child, tail));
+        defineData(out, key, omitPath(child, tail, caseInsensitive));
       continue;
     }
     defineData(out, key, child);
   }
   return out;
 }
-function cloneRecord(value, omittedKeys) {
+function cloneRecord(value, omittedKeys, caseInsensitive = false) {
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (!omittedKeys.has(key))
+    if (!omittedKeys.has(caseInsensitive ? foldCase(key) : key))
       defineData(out, key, child);
   }
   return out;
@@ -16748,9 +17318,11 @@ function defineData(target, key, value) {
     writable: true
   });
 }
-var UNSAFE_SEGMENTS;
+var UNSAFE_SEGMENTS, NARROW_STATE_LIMIT = 4096, foldedKeyIndex;
 var init_field_projection = __esm(() => {
+  init_path_matcher();
   UNSAFE_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+  foldedKeyIndex = new WeakMap;
 });
 
 // src/utils/es-index-target.ts
@@ -16817,16 +17389,16 @@ function expandIndexTargets(target) {
   return { concrete, wildcards };
 }
 function matchesIndexGlob(pattern, name) {
-  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
+  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern;
   try {
-    return globToRegex(normalized).test(name.toLowerCase());
+    return globMatches(normalized, name, { caseInsensitive: true });
   } catch {
     return true;
   }
 }
 function reachesByConvention(name, entry) {
-  const lower = name.toLowerCase();
-  const target = entry.toLowerCase();
+  const lower = foldFieldPath(name);
+  const target = foldFieldPath(entry);
   return new RegExp(`^\\.ds-${escapeRegExp(target)}-`).test(lower) || new RegExp(`^${escapeRegExp(target)}-\\d+$`).test(lower);
 }
 function escapeRegExp(text2) {
@@ -16847,11 +17419,14 @@ function indexExpressionReaches(expression, blacklisted) {
     return false;
   const { concrete, wildcards } = expandIndexTargets(expression);
   const entries = expandBlacklistEntries(blacklisted);
-  const reachesName = (name) => entries.names.some((entry) => entry.toLowerCase() === name.toLowerCase() || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
+  const reachesName = (name) => entries.names.some((entry) => foldFieldPath(entry) === foldFieldPath(name) || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
   return concrete.some(reachesName) || wildcards.some((pattern) => entries.names.some((entry) => matchesIndexGlob(pattern, entry)) || entries.patterns.length > 0);
 }
 var MAX_DECODE_PASSES = 4;
-var init_es_index_target = () => {};
+var init_es_index_target = __esm(() => {
+  init_blacklist_fold();
+  init_glob();
+});
 
 // src/core/blacklist-validator.ts
 function flattenArrayRow(row) {
@@ -16868,7 +17443,7 @@ function dedupe2(values) {
   const seen = new Set;
   const result = [];
   for (const value of values) {
-    const key = value.toLowerCase();
+    const key = foldFieldPath(value);
     if (value.length === 0 || seen.has(key))
       continue;
     seen.add(key);
@@ -16876,6 +17451,20 @@ function dedupe2(values) {
   }
   return result;
 }
+function omittedByName(omittedColumns, path) {
+  return omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`));
+}
+function compileGlobRules(rules, table, operation) {
+  const globbed = rules.filter(isGlobPattern);
+  if (globbed.length === 0)
+    return [];
+  const { patterns, rejected } = compilePatterns(globbed);
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
+  }
+  return patterns;
+}
 
 class BlacklistValidator {
   manager;
@@ -16933,7 +17522,27 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const conflicts = fields.filter((f) => blacklisted.includes(f));
+    const protectedPaths = new Set(blacklisted.map(foldFieldPath));
+    const globs = compileGlobRules(blacklisted, tableName, operation);
+    const conflicts = fields.filter((field) => {
+      const name = foldFieldPath(field);
+      if (protectedPaths.has(name))
+        return true;
+      if (matchAny(name, globs))
+        return true;
+      let dot = name.indexOf(".");
+      while (dot >= 0) {
+        if (dot > 0) {
+          const ancestor = name.slice(0, dot);
+          if (protectedPaths.has(ancestor))
+            return true;
+          if (matchAny(ancestor, globs))
+            return true;
+        }
+        dot = name.indexOf(".", dot + 1);
+      }
+      return false;
+    });
     if (conflicts.length === 0) {
       return;
     }
@@ -16959,7 +17568,7 @@ class BlacklistValidator {
     const tables = dedupe2(tableNames);
     const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
     const probeNested = blacklistedColumns.some((path) => path.includes("."));
     const presentColumns = new Set(columnList);
@@ -16971,7 +17580,7 @@ class BlacklistValidator {
           continue;
         const value = record[key];
         if (value !== null && typeof value === "object")
-          nestedHeads.add(key);
+          nestedHeads.add(foldFieldPath(key));
       }
     };
     for (const row of rows) {
@@ -16984,38 +17593,103 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const protectedPaths = new Set(blacklistedColumns);
+    const protectedPaths = new Set(blacklistedColumns.map(foldFieldPath));
+    const globRules = compileGlobRules(blacklistedColumns, tables[0] ?? "unknown", "SELECT");
+    const presentByFolded = new Map;
+    for (const column of presentColumns) {
+      const folded = foldFieldPath(column);
+      const names = presentByFolded.get(folded);
+      if (names === undefined)
+        presentByFolded.set(folded, [column]);
+      else
+        names.push(column);
+    }
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      if (presentColumns.has(path)) {
-        omitted.add(path);
+      const present = presentByFolded.get(foldFieldPath(path));
+      if (present !== undefined) {
+        for (const name of present)
+          omitted.add(name);
         continue;
       }
       const dot = path.indexOf(".");
       if (dot < 0)
         continue;
-      if (!nestedHeads.has(path.slice(0, dot)))
+      if (!nestedHeads.has(foldFieldPath(path.slice(0, dot))))
         continue;
-      const segments = path.split(".");
-      if (rows.some((row) => hasFieldPath(row, segments)))
+      const segments = path.split(".").map(foldFieldPath);
+      if (rows.some((row) => hasFieldPath(row, segments, PRE_FOLDED)))
         omitted.add(path);
     }
+    const nestedGlobs = globRules.filter((pattern) => pattern.segments.length > 1);
+    const matchedNested = [];
+    if (nestedGlobs.length > 0 && nestedHeads.size > 0) {
+      const pending = new Set(nestedGlobs);
+      const states = compileNestedRules(nestedGlobs);
+      for (const row of rows) {
+        if (pending.size === 0)
+          break;
+        if (row === null || typeof row !== "object")
+          continue;
+        collectNestedMatches(row, states, pending, (pattern) => {
+          matchedNested.push(pattern);
+          omitted.add(pattern.raw);
+        });
+      }
+    }
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot))) {
+        if (dot > 0 && protectedPaths.has(foldFieldPath(column.slice(0, dot)))) {
           omitted.add(column);
           break;
         }
         dot = column.indexOf(".", dot + 1);
       }
     }
+    if (globRules.length > 0) {
+      for (const column of presentColumns) {
+        const folded = foldFieldPath(column);
+        if (matchAny(folded, globRules)) {
+          omitted.add(column);
+          continue;
+        }
+        let dot = folded.indexOf(".");
+        while (dot >= 0) {
+          if (dot > 0 && matchAny(folded.slice(0, dot), globRules)) {
+            omitted.add(column);
+            break;
+          }
+          dot = folded.indexOf(".", dot + 1);
+        }
+      }
+    }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
-    const filteredRows = omitFieldPaths(rows, omittedColumns);
-    return { filteredRows, omittedColumns };
+    const removalPaths = matchedNested.length === 0 ? omittedColumns : omittedColumns.filter((path) => !matchedNested.some((p) => p.raw === path));
+    const filteredRows = omitFieldPaths(rows, removalPaths, matchedNested.length > 0 ? { ...FOLD_CASE2, patterns: matchedNested } : FOLD_CASE2);
+    return {
+      filteredRows,
+      omittedColumns,
+      reachesOmitted: (path) => {
+        if (omittedByName(removalPaths, path))
+          return true;
+        if (matchedNested.length === 0)
+          return false;
+        const folded = foldFieldPath(path);
+        if (matchAny(folded, matchedNested))
+          return true;
+        let dot = folded.indexOf(".");
+        while (dot > 0) {
+          if (matchAny(folded.slice(0, dot), matchedNested))
+            return true;
+          dot = folded.indexOf(".", dot + 1);
+        }
+        return false;
+      }
+    };
   }
   buildSecurityNotification(_tableName, omittedColumns) {
     if (omittedColumns.length === 0) {
@@ -17026,11 +17700,17 @@ class BlacklistValidator {
     });
   }
 }
+var FOLD_CASE2, PRE_FOLDED;
 var init_blacklist_validator = __esm(() => {
+  init_glob();
   init_blacklist();
   init_message_loader();
   init_field_projection();
+  init_path_matcher();
+  init_blacklist_fold();
   init_es_index_target();
+  FOLD_CASE2 = { caseInsensitive: true };
+  PRE_FOLDED = { caseInsensitive: true, alreadyFolded: true };
 });
 
 // src/core/verification/types.ts
@@ -18040,6 +18720,7 @@ var init_core = __esm(() => {
   init_schema_updater();
   init_concurrent_lock();
   init_error_recovery();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_size_category();
   init_health_checker();
@@ -18418,6 +19099,355 @@ var init_sql_lexical = __esm(() => {
   DOLLAR_QUOTE_DELIMITER = /^\$(?:(?:[A-Za-z_]|[\u0080-\uFFFF])(?:[A-Za-z0-9_]|[\u0080-\uFFFF])*)?\$/;
 });
 
+// src/utils/sql-tables.ts
+var exports_sql_tables = {};
+__export(exports_sql_tables, {
+  extractTableReferences: () => extractTableReferences
+});
+function tokenize(sql, dialect, backslashEscapes) {
+  const tokens = [];
+  const mysqlDialect = dialect === "mysql" || dialect === "mariadb";
+  let i = 0;
+  while (i < sql.length) {
+    const char = sql[i];
+    const dashFollowerCode = sql.charCodeAt(i + 2);
+    if (char === "-" && sql[i + 1] === "-" && (!mysqlDialect || sql[i + 2] === undefined || dashFollowerCode <= 32 || dashFollowerCode === 127)) {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (mysqlDialect && char === "#") {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (char === "/" && sql[i + 1] === "*") {
+      if (mysqlDialect && (sql.startsWith("/*!", i) || sql.startsWith("/*M!", i))) {
+        const prefixLength = sql.startsWith("/*M!", i) ? 4 : 3;
+        const closingIndex = sql.indexOf("*/", i + prefixLength);
+        const bodyEnd = closingIndex === -1 ? sql.length : closingIndex;
+        const body = sql.slice(i + prefixLength, bodyEnd).replace(/^\d+/, " ");
+        tokens.push(...tokenize(body, dialect, backslashEscapes));
+        i = closingIndex === -1 ? sql.length : closingIndex + 2;
+        continue;
+      }
+      const nests = dialect === "postgresql";
+      let depth = 1;
+      i += 2;
+      while (i < sql.length && depth > 0) {
+        if (nests && sql[i] === "/" && sql[i + 1] === "*") {
+          depth++;
+          i += 2;
+          continue;
+        }
+        if (sql[i] === "*" && sql[i + 1] === "/") {
+          depth--;
+          i += 2;
+          continue;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (dialect === "postgresql" && char === "$") {
+      const delimiter = dollarQuoteDelimiterAt(sql, i);
+      if (delimiter) {
+        i += delimiter.length;
+        const closingIndex = sql.indexOf(delimiter, i);
+        i = closingIndex === -1 ? sql.length : closingIndex + delimiter.length;
+        continue;
+      }
+    }
+    if (char === "'") {
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === "'") {
+          if (sql[i + 1] === "'") {
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (char === '"' || char === "`") {
+      const quote = char;
+      i++;
+      let value = "";
+      while (i < sql.length) {
+        if (sql[i] === quote) {
+          if (sql[i + 1] === quote) {
+            value += quote;
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          value += sql[i + 1] ?? "";
+          i += 2;
+          continue;
+        }
+        value += sql[i];
+        i++;
+      }
+      tokens.push({ value, kind: "identifier", quoted: true });
+      continue;
+    }
+    if (IDENTIFIER_START2.test(char)) {
+      let value = "";
+      while (i < sql.length && IDENTIFIER_PART.test(sql[i])) {
+        value += sql[i];
+        i++;
+      }
+      tokens.push({ value, kind: "identifier", quoted: false });
+      continue;
+    }
+    if (char === "." || char === "," || char === "(" || char === ")" || char === ";") {
+      tokens.push({ value: char, kind: "punctuation", quoted: false });
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return tokens;
+}
+function isKeyword(token, keywords) {
+  if (!token || token.kind !== "identifier" || token.quoted)
+    return false;
+  return keywords.has(token.value.toUpperCase());
+}
+function isPunctuation(token, value) {
+  return token?.kind === "punctuation" && token.value === value;
+}
+function readQualifiedName(tokens, index) {
+  const first = tokens[index];
+  if (!first || first.kind !== "identifier")
+    return null;
+  const parts = [first.value];
+  let cursor = index + 1;
+  while (isPunctuation(tokens[cursor], ".") && tokens[cursor + 1]?.kind === "identifier") {
+    parts.push(tokens[cursor + 1].value);
+    cursor += 2;
+  }
+  return { parts, next: cursor };
+}
+function decodedVariants(value) {
+  const decoded = value.replace(ANY_ESCAPE_SEQUENCE, (whole, _escape, long, short) => fromCodePointOrRaw(long ?? short, whole));
+  return decoded === value ? [] : [decoded];
+}
+function fromCodePointOrRaw(hex, whole) {
+  const codePoint = parseInt(hex, 16);
+  return codePoint <= 1114111 ? String.fromCodePoint(codePoint) : whole;
+}
+function extractTableReferences(sql, options = {}) {
+  const seen = new Set;
+  const references = [];
+  const record = (name) => {
+    const key = name.toLowerCase();
+    if (name.length === 0 || seen.has(key))
+      return;
+    seen.add(key);
+    references.push(name);
+  };
+  const dialects = options.dialect ? [options.dialect] : ["postgresql", "mysql", undefined];
+  for (const dialect of dialects) {
+    for (const backslashEscapes of [false, true]) {
+      collectReferences(tokenize(sql, dialect, backslashEscapes), record);
+    }
+  }
+  return references;
+}
+function collectReferences(tokens, record) {
+  const recordName = (parts) => {
+    const bare = parts[parts.length - 1];
+    record(bare);
+    for (const variant of decodedVariants(bare))
+      record(variant);
+    if (parts.length > 1)
+      record(parts.join("."));
+  };
+  let i = 0;
+  while (i < tokens.length) {
+    if (!isKeyword(tokens[i], TABLE_INTRODUCERS)) {
+      i++;
+      continue;
+    }
+    const introducer = tokens[i].value.toUpperCase();
+    const parenMeansFunction = introducer === "FROM" || introducer === "JOIN";
+    let cursor = i + 1;
+    while (isKeyword(tokens[cursor], PRE_TABLE_NOISE))
+      cursor++;
+    while (parenMeansFunction && isPunctuation(tokens[cursor], "(") && !isKeyword(tokens[cursor + 1], SUBQUERY_OPENERS) && tokens[cursor + 1]?.kind === "identifier") {
+      cursor++;
+    }
+    let expectTable = true;
+    while (expectTable) {
+      expectTable = false;
+      const name = readQualifiedName(tokens, cursor);
+      if (!name)
+        break;
+      const isFunctionCall = parenMeansFunction && isPunctuation(tokens[name.next], "(");
+      if (!isFunctionCall)
+        recordName(name.parts);
+      cursor = name.next;
+      if (isFunctionCall)
+        break;
+      if (isKeyword(tokens[cursor], AS_KEYWORD))
+        cursor++;
+      if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS)) {
+        cursor++;
+      }
+      while (isPunctuation(tokens[cursor], "(")) {
+        let depth = 0;
+        do {
+          if (isPunctuation(tokens[cursor], "("))
+            depth++;
+          else if (isPunctuation(tokens[cursor], ")"))
+            depth--;
+          cursor++;
+        } while (depth > 0 && cursor < tokens.length);
+        if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS))
+          cursor++;
+      }
+      if (isPunctuation(tokens[cursor], ",")) {
+        cursor++;
+        expectTable = true;
+      }
+    }
+    i = Math.max(cursor, i + 1);
+  }
+  let index = 0;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    if (!token || token.kind !== "identifier") {
+      index++;
+      continue;
+    }
+    const name = readQualifiedName(tokens, index);
+    for (let part = 0;part < name.parts.length; part++) {
+      const value = name.parts[part];
+      const isQuoted = tokens[index + part * 2]?.quoted === true;
+      if (isQuoted || !RESERVED_KEYWORDS.has(value.toUpperCase())) {
+        record(value);
+        for (const variant of decodedVariants(value))
+          record(variant);
+      }
+    }
+    if (name.parts.length > 1)
+      record(name.parts.join("."));
+    index = name.next;
+  }
+}
+var TABLE_INTRODUCERS, PRE_TABLE_NOISE, SUBQUERY_OPENERS, AS_KEYWORD, POST_TABLE_KEYWORDS, RESERVED_KEYWORDS, IDENTIFIER_START2, IDENTIFIER_PART, ANY_ESCAPE_SEQUENCE;
+var init_sql_tables = __esm(() => {
+  init_sql_lexical();
+  TABLE_INTRODUCERS = new Set([
+    "FROM",
+    "JOIN",
+    "INTO",
+    "UPDATE",
+    "TABLE",
+    "TRUNCATE",
+    "COPY",
+    "USING",
+    "STRAIGHT_JOIN"
+  ]);
+  PRE_TABLE_NOISE = new Set(["ONLY", "LATERAL", "TABLE"]);
+  SUBQUERY_OPENERS = new Set(["SELECT", "WITH", "VALUES", "TABLE"]);
+  AS_KEYWORD = new Set(["AS"]);
+  POST_TABLE_KEYWORDS = new Set([
+    "AS",
+    "ON",
+    "USING",
+    "WHERE",
+    "GROUP",
+    "ORDER",
+    "HAVING",
+    "LIMIT",
+    "OFFSET",
+    "FETCH",
+    "WINDOW",
+    "UNION",
+    "INTERSECT",
+    "EXCEPT",
+    "JOIN",
+    "INNER",
+    "LEFT",
+    "RIGHT",
+    "FULL",
+    "OUTER",
+    "CROSS",
+    "NATURAL",
+    "STRAIGHT_JOIN",
+    "SET",
+    "VALUES",
+    "SELECT",
+    "RETURNING",
+    "FOR",
+    "INTO",
+    "PARTITION",
+    "WITH",
+    "TABLESAMPLE",
+    "FORCE",
+    "IGNORE",
+    "USE"
+  ]);
+  RESERVED_KEYWORDS = new Set([
+    "ALL",
+    "AND",
+    "AS",
+    "ASC",
+    "CASE",
+    "CROSS",
+    "DESC",
+    "DISTINCT",
+    "ELSE",
+    "FALSE",
+    "FOR",
+    "FROM",
+    "GROUP",
+    "HAVING",
+    "IN",
+    "INNER",
+    "INTO",
+    "IS",
+    "JOIN",
+    "LEFT",
+    "LIKE",
+    "LIMIT",
+    "NOT",
+    "NULL",
+    "ON",
+    "OR",
+    "ORDER",
+    "OUTER",
+    "RIGHT",
+    "SELECT",
+    "THEN",
+    "TRUE",
+    "UNION",
+    "USING",
+    "VALUES",
+    "WHEN",
+    "WHERE",
+    "WITH"
+  ]);
+  IDENTIFIER_START2 = /[A-Za-z_\u0080-\uFFFF]/;
+  IDENTIFIER_PART = /[A-Za-z0-9_$\u0080-\uFFFF]/;
+  ANY_ESCAPE_SEQUENCE = /([^0-9a-fA-F+'"\s])(?:\+([0-9a-fA-F]{6})|([0-9a-fA-F]{4}))/g;
+});
+
 // src/core/permission/sql-analysis.ts
 function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
@@ -19010,6 +20040,9 @@ var init_engine_hints = __esm(() => {
 });
 
 // src/core/audit/integration-helper.ts
+function sqlDialectFor(engine) {
+  return SQL_AUDIT_DIALECTS.includes(engine) ? engine : null;
+}
 async function getAuditLogger(config, configPath, connectionName) {
   const storagePath = await resolveConfigStoragePath(configPath);
   const connName = connectionName || config.effectiveConnectionName || getGlobalConnectionName() || "default";
@@ -19051,6 +20084,8 @@ async function writeAuditEntryResult(config, commandName, options, outcome) {
     const logger = await getAuditLogger(config, options.config || ".dbcli", connectionName);
     const engine = config.connection?.system || "postgresql";
     const target = outcome.target || getOperationTarget(engine, commandName, options, outcome.sql);
+    const auditDialect = sqlDialectFor(engine);
+    const blacklistChecked = auditDialect ? extractTableReferences(outcome.sql ?? "", { dialect: auditDialect }) : [];
     let tier = outcome.sideEffectTier ?? getEngineCapability(engine, commandName).tier;
     if (options.dryRun || options.plan) {
       tier = "dry-run";
@@ -19075,6 +20110,7 @@ async function writeAuditEntryResult(config, commandName, options, outcome) {
       ...outcome.recovery_ref && { recovery_ref: outcome.recovery_ref },
       metadata: {
         ...outcome.metadata ?? {},
+        ...blacklistChecked.length > 0 && { blacklist_checked: blacklistChecked },
         connection_name: connectionName,
         environment: config.effectiveEnvironment ?? null
       }
@@ -19087,15 +20123,17 @@ async function writeAuditEntryResult(config, commandName, options, outcome) {
     };
   }
 }
-var _sessionIdService = null, _loggers, AuditRequiredError;
+var SQL_AUDIT_DIALECTS, _sessionIdService = null, _loggers, AuditRequiredError;
 var init_integration_helper = __esm(() => {
   init_logger2();
   init_session_id();
   init_config_binding();
   init_config();
   init_capabilities();
+  init_sql_tables();
   init_redaction();
   init_engine_hints();
+  SQL_AUDIT_DIALECTS = ["postgresql", "mysql", "mariadb"];
   _loggers = new Map;
   AuditRequiredError = class AuditRequiredError extends Error {
     constructor(detail) {
@@ -19170,73 +20208,6 @@ async function getAllTablesFromAdapter(adapter) {
 }
 var init_error_suggester = () => {};
 
-// src/core/mongo/path-matcher.ts
-function compilePatterns(raw) {
-  const patterns = [];
-  const rejected = [];
-  for (const entry of raw) {
-    if (typeof entry !== "string" || entry.length === 0) {
-      rejected.push({ raw: String(entry ?? ""), reason: "must be a non-empty string" });
-      continue;
-    }
-    const segments = entry.split(".");
-    if (segments.length === 0 || segments.some((s) => s.length === 0)) {
-      rejected.push({ raw: entry, reason: "empty path segment" });
-      continue;
-    }
-    const wildcardIndices = segments.map((s, i) => s.includes("*") ? i : -1).filter((i) => i >= 0);
-    if (wildcardIndices.length === 0) {
-      patterns.push({ raw: entry, segments, wildcardTail: false });
-      continue;
-    }
-    const lastIndex = segments.length - 1;
-    const onlyTail = wildcardIndices.length === 1 && wildcardIndices[0] === lastIndex && segments[lastIndex] === "*";
-    if (!onlyTail) {
-      rejected.push({ raw: entry, reason: "wildcard must be the final segment" });
-      continue;
-    }
-    if (segments.length === 1) {
-      rejected.push({ raw: entry, reason: "wildcard must have a parent path" });
-      continue;
-    }
-    patterns.push({ raw: entry, segments: segments.slice(0, -1), wildcardTail: true });
-  }
-  return { patterns, rejected };
-}
-function matchAny(path, patterns) {
-  if (patterns.length === 0)
-    return false;
-  const pathSegments = path.split(".");
-  for (const pat of patterns) {
-    if (pat.wildcardTail) {
-      if (pathSegments.length < pat.segments.length)
-        continue;
-      let ok = true;
-      for (let i = 0;i < pat.segments.length; i++) {
-        if (pat.segments[i] !== pathSegments[i]) {
-          ok = false;
-          break;
-        }
-      }
-      if (ok)
-        return true;
-    } else {
-      if (pat.segments.length !== pathSegments.length)
-        continue;
-      let ok = true;
-      for (let i = 0;i < pat.segments.length; i++) {
-        if (pat.segments[i] !== pathSegments[i]) {
-          ok = false;
-          break;
-        }
-      }
-      if (ok)
-        return true;
-    }
-  }
-  return false;
-}
-
 // src/utils/bounded-parallel.ts
 async function mapWithConcurrency(items, limit, worker) {
   if (items.length === 0)
@@ -21322,7 +22293,11 @@ function markRedactedColumns(cols, collection, blacklist) {
   const raw = (blacklist.columns ?? {})[collection];
   if (!raw || raw.length === 0)
     return cols;
-  const { patterns } = compilePatterns(raw);
+  const { patterns, rejected } = compilePatterns(raw);
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new Error(`blacklist.columns for '${collection}' has entries this matcher cannot read: ${detail}`);
+  }
   if (patterns.length === 0)
     return cols;
   return cols.map((c) => matchAny(c.name, patterns) ? { ...c, redacted: true } : c);
@@ -21452,7 +22427,7 @@ Key: ${schema.name}`);
         await esAdapter.disconnect();
       }
     }
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter(config);
     await adapter.connect();
     const mongoMeta = config.connection.system === "mongodb" ? {
       blacklist: config.blacklist ?? { tables: [], columns: {} },
@@ -21770,6 +22745,7 @@ var init_schema = __esm(() => {
   init_validation();
   init_connection_selector();
   init_error_suggester();
+  init_path_matcher();
   init_config_path();
   ALLOWED_FORMATS2 = ["table", "json"];
   schemaCommand = new Command().name("schema").description("Display table schema, scan database schema, or refresh existing schema with detected changes").argument("[table]", "Optional: table name to inspect (if omitted, scans all tables)").option("--format <format>", "Output format: table (default) or json", "table").option("--config <path>", "Path to .dbcli config file", ".dbcli").addOption(createConnectionSelectorOption()).option("--refresh", "Refresh schema by detecting changes from database", false).option("--reset", "Clear all existing schema data and re-fetch from database", false).option("--force", "Skip confirmation when updating schema data", false).option("--sample-size <n>", "MongoDB only: number of documents to sample for schema inference (default 100, max 1000). Ignored on SQL connections.").option("--sample-method <method>", 'MongoDB only: "random" (default, uses $sample) or "natural" (uses find().limit()). Ignored on SQL connections.', "random").option("--recovery", "On failure, emit a structured recovery envelope to stdout (suppresses human stderr message)", false).action(schemaAction);
@@ -21874,355 +22850,6 @@ async function openInBrowser(target) {
 }
 var init_opener = () => {};
 
-// src/utils/sql-tables.ts
-var exports_sql_tables = {};
-__export(exports_sql_tables, {
-  extractTableReferences: () => extractTableReferences
-});
-function tokenize(sql, dialect, backslashEscapes) {
-  const tokens = [];
-  const mysqlDialect = dialect === "mysql" || dialect === "mariadb";
-  let i = 0;
-  while (i < sql.length) {
-    const char = sql[i];
-    const dashFollowerCode = sql.charCodeAt(i + 2);
-    if (char === "-" && sql[i + 1] === "-" && (!mysqlDialect || sql[i + 2] === undefined || dashFollowerCode <= 32 || dashFollowerCode === 127)) {
-      while (i < sql.length && sql[i] !== `
-`)
-        i++;
-      continue;
-    }
-    if (mysqlDialect && char === "#") {
-      while (i < sql.length && sql[i] !== `
-`)
-        i++;
-      continue;
-    }
-    if (char === "/" && sql[i + 1] === "*") {
-      if (mysqlDialect && (sql.startsWith("/*!", i) || sql.startsWith("/*M!", i))) {
-        const prefixLength = sql.startsWith("/*M!", i) ? 4 : 3;
-        const closingIndex = sql.indexOf("*/", i + prefixLength);
-        const bodyEnd = closingIndex === -1 ? sql.length : closingIndex;
-        const body = sql.slice(i + prefixLength, bodyEnd).replace(/^\d+/, " ");
-        tokens.push(...tokenize(body, dialect, backslashEscapes));
-        i = closingIndex === -1 ? sql.length : closingIndex + 2;
-        continue;
-      }
-      const nests = dialect === "postgresql";
-      let depth = 1;
-      i += 2;
-      while (i < sql.length && depth > 0) {
-        if (nests && sql[i] === "/" && sql[i + 1] === "*") {
-          depth++;
-          i += 2;
-          continue;
-        }
-        if (sql[i] === "*" && sql[i + 1] === "/") {
-          depth--;
-          i += 2;
-          continue;
-        }
-        i++;
-      }
-      continue;
-    }
-    if (dialect === "postgresql" && char === "$") {
-      const delimiter = dollarQuoteDelimiterAt(sql, i);
-      if (delimiter) {
-        i += delimiter.length;
-        const closingIndex = sql.indexOf(delimiter, i);
-        i = closingIndex === -1 ? sql.length : closingIndex + delimiter.length;
-        continue;
-      }
-    }
-    if (char === "'") {
-      i++;
-      while (i < sql.length) {
-        if (sql[i] === "'") {
-          if (sql[i + 1] === "'") {
-            i += 2;
-            continue;
-          }
-          i++;
-          break;
-        }
-        if (backslashEscapes && sql[i] === "\\") {
-          i += 2;
-          continue;
-        }
-        i++;
-      }
-      continue;
-    }
-    if (char === '"' || char === "`") {
-      const quote = char;
-      i++;
-      let value = "";
-      while (i < sql.length) {
-        if (sql[i] === quote) {
-          if (sql[i + 1] === quote) {
-            value += quote;
-            i += 2;
-            continue;
-          }
-          i++;
-          break;
-        }
-        if (backslashEscapes && sql[i] === "\\") {
-          value += sql[i + 1] ?? "";
-          i += 2;
-          continue;
-        }
-        value += sql[i];
-        i++;
-      }
-      tokens.push({ value, kind: "identifier", quoted: true });
-      continue;
-    }
-    if (IDENTIFIER_START2.test(char)) {
-      let value = "";
-      while (i < sql.length && IDENTIFIER_PART.test(sql[i])) {
-        value += sql[i];
-        i++;
-      }
-      tokens.push({ value, kind: "identifier", quoted: false });
-      continue;
-    }
-    if (char === "." || char === "," || char === "(" || char === ")" || char === ";") {
-      tokens.push({ value: char, kind: "punctuation", quoted: false });
-      i++;
-      continue;
-    }
-    i++;
-  }
-  return tokens;
-}
-function isKeyword(token, keywords) {
-  if (!token || token.kind !== "identifier" || token.quoted)
-    return false;
-  return keywords.has(token.value.toUpperCase());
-}
-function isPunctuation(token, value) {
-  return token?.kind === "punctuation" && token.value === value;
-}
-function readQualifiedName(tokens, index) {
-  const first = tokens[index];
-  if (!first || first.kind !== "identifier")
-    return null;
-  const parts = [first.value];
-  let cursor = index + 1;
-  while (isPunctuation(tokens[cursor], ".") && tokens[cursor + 1]?.kind === "identifier") {
-    parts.push(tokens[cursor + 1].value);
-    cursor += 2;
-  }
-  return { parts, next: cursor };
-}
-function decodedVariants(value) {
-  const decoded = value.replace(ANY_ESCAPE_SEQUENCE, (whole, _escape, long, short) => fromCodePointOrRaw(long ?? short, whole));
-  return decoded === value ? [] : [decoded];
-}
-function fromCodePointOrRaw(hex, whole) {
-  const codePoint = parseInt(hex, 16);
-  return codePoint <= 1114111 ? String.fromCodePoint(codePoint) : whole;
-}
-function extractTableReferences(sql, options = {}) {
-  const seen = new Set;
-  const references = [];
-  const record = (name) => {
-    const key = name.toLowerCase();
-    if (name.length === 0 || seen.has(key))
-      return;
-    seen.add(key);
-    references.push(name);
-  };
-  const dialects = options.dialect ? [options.dialect] : ["postgresql", "mysql", undefined];
-  for (const dialect of dialects) {
-    for (const backslashEscapes of [false, true]) {
-      collectReferences(tokenize(sql, dialect, backslashEscapes), record);
-    }
-  }
-  return references;
-}
-function collectReferences(tokens, record) {
-  const recordName = (parts) => {
-    const bare = parts[parts.length - 1];
-    record(bare);
-    for (const variant of decodedVariants(bare))
-      record(variant);
-    if (parts.length > 1)
-      record(parts.join("."));
-  };
-  let i = 0;
-  while (i < tokens.length) {
-    if (!isKeyword(tokens[i], TABLE_INTRODUCERS)) {
-      i++;
-      continue;
-    }
-    const introducer = tokens[i].value.toUpperCase();
-    const parenMeansFunction = introducer === "FROM" || introducer === "JOIN";
-    let cursor = i + 1;
-    while (isKeyword(tokens[cursor], PRE_TABLE_NOISE))
-      cursor++;
-    while (parenMeansFunction && isPunctuation(tokens[cursor], "(") && !isKeyword(tokens[cursor + 1], SUBQUERY_OPENERS) && tokens[cursor + 1]?.kind === "identifier") {
-      cursor++;
-    }
-    let expectTable = true;
-    while (expectTable) {
-      expectTable = false;
-      const name = readQualifiedName(tokens, cursor);
-      if (!name)
-        break;
-      const isFunctionCall = parenMeansFunction && isPunctuation(tokens[name.next], "(");
-      if (!isFunctionCall)
-        recordName(name.parts);
-      cursor = name.next;
-      if (isFunctionCall)
-        break;
-      if (isKeyword(tokens[cursor], AS_KEYWORD))
-        cursor++;
-      if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS)) {
-        cursor++;
-      }
-      while (isPunctuation(tokens[cursor], "(")) {
-        let depth = 0;
-        do {
-          if (isPunctuation(tokens[cursor], "("))
-            depth++;
-          else if (isPunctuation(tokens[cursor], ")"))
-            depth--;
-          cursor++;
-        } while (depth > 0 && cursor < tokens.length);
-        if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS))
-          cursor++;
-      }
-      if (isPunctuation(tokens[cursor], ",")) {
-        cursor++;
-        expectTable = true;
-      }
-    }
-    i = Math.max(cursor, i + 1);
-  }
-  let index = 0;
-  while (index < tokens.length) {
-    const token = tokens[index];
-    if (!token || token.kind !== "identifier") {
-      index++;
-      continue;
-    }
-    const name = readQualifiedName(tokens, index);
-    for (let part = 0;part < name.parts.length; part++) {
-      const value = name.parts[part];
-      const isQuoted = tokens[index + part * 2]?.quoted === true;
-      if (isQuoted || !RESERVED_KEYWORDS.has(value.toUpperCase())) {
-        record(value);
-        for (const variant of decodedVariants(value))
-          record(variant);
-      }
-    }
-    if (name.parts.length > 1)
-      record(name.parts.join("."));
-    index = name.next;
-  }
-}
-var TABLE_INTRODUCERS, PRE_TABLE_NOISE, SUBQUERY_OPENERS, AS_KEYWORD, POST_TABLE_KEYWORDS, RESERVED_KEYWORDS, IDENTIFIER_START2, IDENTIFIER_PART, ANY_ESCAPE_SEQUENCE;
-var init_sql_tables = __esm(() => {
-  init_sql_lexical();
-  TABLE_INTRODUCERS = new Set([
-    "FROM",
-    "JOIN",
-    "INTO",
-    "UPDATE",
-    "TABLE",
-    "TRUNCATE",
-    "COPY",
-    "USING",
-    "STRAIGHT_JOIN"
-  ]);
-  PRE_TABLE_NOISE = new Set(["ONLY", "LATERAL", "TABLE"]);
-  SUBQUERY_OPENERS = new Set(["SELECT", "WITH", "VALUES", "TABLE"]);
-  AS_KEYWORD = new Set(["AS"]);
-  POST_TABLE_KEYWORDS = new Set([
-    "AS",
-    "ON",
-    "USING",
-    "WHERE",
-    "GROUP",
-    "ORDER",
-    "HAVING",
-    "LIMIT",
-    "OFFSET",
-    "FETCH",
-    "WINDOW",
-    "UNION",
-    "INTERSECT",
-    "EXCEPT",
-    "JOIN",
-    "INNER",
-    "LEFT",
-    "RIGHT",
-    "FULL",
-    "OUTER",
-    "CROSS",
-    "NATURAL",
-    "STRAIGHT_JOIN",
-    "SET",
-    "VALUES",
-    "SELECT",
-    "RETURNING",
-    "FOR",
-    "INTO",
-    "PARTITION",
-    "WITH",
-    "TABLESAMPLE",
-    "FORCE",
-    "IGNORE",
-    "USE"
-  ]);
-  RESERVED_KEYWORDS = new Set([
-    "ALL",
-    "AND",
-    "AS",
-    "ASC",
-    "CASE",
-    "CROSS",
-    "DESC",
-    "DISTINCT",
-    "ELSE",
-    "FALSE",
-    "FOR",
-    "FROM",
-    "GROUP",
-    "HAVING",
-    "IN",
-    "INNER",
-    "INTO",
-    "IS",
-    "JOIN",
-    "LEFT",
-    "LIKE",
-    "LIMIT",
-    "NOT",
-    "NULL",
-    "ON",
-    "OR",
-    "ORDER",
-    "OUTER",
-    "RIGHT",
-    "SELECT",
-    "THEN",
-    "TRUE",
-    "UNION",
-    "USING",
-    "VALUES",
-    "WHEN",
-    "WHERE",
-    "WITH"
-  ]);
-  IDENTIFIER_START2 = /[A-Za-z_\u0080-\uFFFF]/;
-  IDENTIFIER_PART = /[A-Za-z0-9_$\u0080-\uFFFF]/;
-  ANY_ESCAPE_SEQUENCE = /([^0-9a-fA-F+'"\s])(?:\+([0-9a-fA-F]{6})|([0-9a-fA-F]{4}))/g;
-});
-
 // src/core/limits.ts
 var DEFAULT_QUERY_ONLY_LIMIT = 1000;
 
@@ -22289,12 +22916,12 @@ class QueryExecutor {
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
       let filteredRows = rows;
       let securityNotification;
-      let omittedColumns = [];
+      let reachesOmitted = () => false;
       if (this.blacklistValidator) {
         const filterResult = this.blacklistValidator.filterColumnsForTables(referencedTables, rows, columnNames);
         filteredRows = filterResult.filteredRows;
         if (filterResult.omittedColumns.length > 0) {
-          omittedColumns = filterResult.omittedColumns;
+          reachesOmitted = filterResult.reachesOmitted;
           columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
           securityNotification = this.blacklistValidator.buildSecurityNotification(referencedTables[0] ?? "", filterResult.omittedColumns);
         }
@@ -22302,7 +22929,7 @@ class QueryExecutor {
       if (options?.fieldSelection) {
         const fieldSelection = options.fieldSelection.mode === "include" ? {
           mode: "include",
-          paths: options.fieldSelection.paths.filter((path2) => !omittedColumns.some((omitted) => path2 === omitted || path2.startsWith(`${omitted}.`)))
+          paths: options.fieldSelection.paths.filter((path2) => !reachesOmitted(path2))
         } : options.fieldSelection;
         const projection = projectRows(filteredRows, fieldSelection);
         filteredRows = projection.rows;
@@ -22402,7 +23029,10 @@ function maskMongoRowsForCollections(rows, collections, blacklist) {
     const prefixKey = `\x00${scope.collection}@${scope.prefix}`;
     return maskMongoRows(atTopLevel, prefixKey, {
       ...blacklist,
-      columns: { ...columns, [prefixKey]: rules.map((rule) => `${scope.prefix}.${rule}`) }
+      columns: {
+        ...columns,
+        [prefixKey]: rules.map((rule) => `${escapeGlob(scope.prefix)}.${rule}`)
+      }
     });
   }, rows);
 }
@@ -22411,10 +23041,14 @@ function maskMongoRows(rows, collection, blacklist) {
   const raw = columns[collection] ?? findCaseInsensitive(columns, collection);
   if (!raw || raw.length === 0)
     return rows;
-  const { patterns } = compilePatterns(raw);
+  const { patterns, rejected } = compilePatterns(raw);
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new BlacklistError(`blacklist.columns for '${collection}' has entries this matcher cannot read: ${detail}`, collection, "READ");
+  }
   if (patterns.length === 0)
     return rows;
-  const idAffected = patterns.some((p) => p.segments.length === 1 && p.segments[0] === "_id" && !p.wildcardTail);
+  const idAffected = patterns.some((p) => p.segments.length === 1 && !p.wildcardTail && globMatches(p.segments[0], "_id", { caseInsensitive: true }));
   if (idAffected) {
     console.error(`[blacklist] collection '${collection}' blacklists '_id'; read paths still expose _id to preserve document references.`);
   }
@@ -22440,7 +23074,7 @@ function maskValue(value, path2, patterns) {
   if (value === null || value === undefined)
     return value;
   if (Array.isArray(value)) {
-    return value.map((item) => item && typeof item === "object" && !Array.isArray(item) ? maskRecord(item, path2, patterns) : item);
+    return value.map((item) => maskValue(item, path2, patterns));
   }
   if (typeof value === "object") {
     return maskRecord(value, path2, patterns);
@@ -22448,15 +23082,21 @@ function maskValue(value, path2, patterns) {
   return value;
 }
 function findCaseInsensitive(columns, name) {
-  const target = name.toLowerCase();
+  const target = foldFieldPath(name);
   for (const [k, v] of Object.entries(columns)) {
-    if (k.toLowerCase() === target)
+    if (foldFieldPath(k) === target)
       return v;
   }
   return;
 }
 var REDACTED2 = "[REDACTED]";
-var init_field_masker = () => {};
+var init_field_masker = __esm(() => {
+  init_blacklist();
+  init_path_matcher();
+  init_blacklist_fold();
+  init_glob();
+  init_glob();
+});
 
 // src/core/mongo/collection-references.ts
 function recordTarget(value, found) {
@@ -24224,6 +24864,7 @@ var init_query = __esm(() => {
   init_opener();
   init_query_executor();
   init_config();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_config_path();
   init_validation();
@@ -24570,9 +25211,9 @@ function applySelectPatternRules(facts, factors) {
   }
 }
 function applyBlacklistRules(facts, blacklist, factors) {
-  const blacklistedTables = new Set((blacklist.tables ?? []).map((table) => table.toLowerCase()));
+  const blacklistedTables = new Set((blacklist.tables ?? []).map(foldFieldPath));
   for (const table of facts.targetTables) {
-    if (blacklistedTables.has(table.toLowerCase())) {
+    if (blacklistedTables.has(foldFieldPath(table))) {
       pushFactor(factors, "table_blacklisted", "block", `Target table ${table} is blacklisted.`);
     }
   }
@@ -24588,7 +25229,7 @@ function applyBlacklistRules(facts, blacklist, factors) {
 function findBlacklistedColumnsForTable(blacklist, table) {
   const columns = blacklist.columns ?? {};
   for (const [tableName2, columnNames] of Object.entries(columns)) {
-    if (tableName2.toLowerCase() === table.toLowerCase()) {
+    if (foldFieldPath(tableName2) === foldFieldPath(table)) {
       return new Set(columnNames);
     }
   }
@@ -24679,6 +25320,7 @@ function buildSuggestedCommands(facts, gap) {
 }
 var READ_LIKE_WORDS, WRITE_OR_DDL_LIKE_WORDS;
 var init_query_risk_analyzer = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
   init_size_category();
   READ_LIKE_WORDS = ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN", "WITH"];
@@ -26161,6 +26803,7 @@ async function qMongoBranch(snippet, prepared, options, config) {
 }
 var init_q_mongo = __esm(() => {
   init_adapters();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_field_masker();
   init_collection_references();
@@ -26234,6 +26877,19 @@ async function qCommand(name, options, command) {
     const family = engineFamily(engine);
     const sqlDialect = SQL_DIALECTS.find((dialect) => dialect === connectionSystem);
     const classification = family === "sql" ? enforcePermission(prepared.rewrittenSql, config.permission, sqlDialect) : undefined;
+    const blacklistManager = new BlacklistManager(config);
+    const blacklistValidator = new BlacklistValidator(blacklistManager);
+    const redisTokens = family === "redis" ? parseRedisCommand(prepared.rewrittenSql) : [];
+    const targets = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
+      ...sqlDialect ? { dialect: sqlDialect } : {}
+    }) : family === "es" ? [prepared.execHints?.index ?? ""] : family === "redis" && redisTokens.length > 0 ? redisCommandTargets(redisTokens[0], redisTokens.slice(1)) : [];
+    const targetName = targets[0] ?? "";
+    targetNameForAudit = family === "redis" ? name : targetName || name;
+    if (family === "es") {
+      blacklistValidator.checkIndexBlacklist("SELECT", targetName);
+    } else if ((classification || family === "redis") && targets.length > 0) {
+      blacklistValidator.checkTablesBlacklist(classification?.type ?? redisTokens[0] ?? "READ", targets);
+    }
     if (options.dryRun) {
       console.log(formatDryRun({
         family,
@@ -26255,19 +26911,7 @@ async function qCommand(name, options, command) {
       await qMongoBranch2(snippet, prepared, options, config);
       return;
     }
-    const blacklistManager = new BlacklistManager(config);
-    const blacklistValidator = new BlacklistValidator(blacklistManager);
-    const targets = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
-      ...sqlDialect ? { dialect: sqlDialect } : {}
-    }) : family === "es" ? [prepared.execHints?.index ?? ""] : [];
-    const targetName = targets[0] ?? "";
-    targetNameForAudit = targetName || name;
-    if (family === "es") {
-      blacklistValidator.checkIndexBlacklist("SELECT", targetName);
-    } else if (classification && targets.length > 0) {
-      blacklistValidator.checkTablesBlacklist(classification.type, targets);
-    }
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter(config);
     await adapter.connect();
     try {
       if (!options.ui && options.format !== "html") {
@@ -26388,6 +27032,8 @@ async function readParamFile(path2) {
   return parsed;
 }
 async function handleQError(error, snippetName, options, config) {
+  const redisBlacklistRejection = config?.connection?.system === "redis" && (error instanceof BlacklistError || error instanceof BlacklistRejection);
+  const reportedError = redisBlacklistRejection ? new BlacklistError(t("errors.redis_target_blacklisted"), "[REDACTED]", error instanceof BlacklistError ? error.operation : error.command) : error;
   let auditId = null;
   let envelopeId;
   if (options.recovery === true) {
@@ -26397,21 +27043,22 @@ async function handleQError(error, snippetName, options, config) {
     auditId = await writeAuditEntry(config, "q", options, {
       success: false,
       target: snippetName,
-      error,
+      error: reportedError,
       ...envelopeId && { recovery_ref: envelopeId }
     });
   }
   if (envelopeId !== undefined) {
     const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
-    emitRecoveryEnvelope2(error, { operation: "q", snippet: snippetName }, { envelopeId, auditRef: auditId ?? undefined });
+    emitRecoveryEnvelope2(reportedError, { operation: "q", snippet: snippetName }, { envelopeId, auditRef: auditId ?? undefined });
   }
   if (error instanceof SavedQueryError) {
     printLocalizedCliError(error.message, error);
     process.exit(1);
   }
-  if (error instanceof BlacklistError) {
-    printLocalizedCliError(error.message, error);
+  if (error instanceof BlacklistError || error instanceof BlacklistRejection) {
+    printLocalizedCliError(reportedError.message, reportedError);
     process.exit(1);
+    return;
   }
   if (error instanceof PermissionError) {
     printLocalizedCliError(t_vars("errors.permission_denied", { required: error.requiredPermission }), error);
@@ -26522,8 +27169,12 @@ function evaluateExpectation(row, expects) {
 var init_q = __esm(() => {
   init_message_loader();
   init_adapters();
+  init_redis_adapter();
+  init_blacklist_enforcer();
+  init_types3();
   init_config();
   init_config_path();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_blacklist();
   init_permission_guard();
@@ -26792,6 +27443,366 @@ function previewDelete(collection, filter) {
 }
 var INDENT = 2;
 
+// src/utils/where-parser.ts
+function parseWhereClause(whereClause) {
+  if (!whereClause || whereClause.trim() === "") {
+    throw new Error("WHERE clause cannot be empty");
+  }
+  const conditions = {};
+  const andParts = whereClause.split(/\s+AND\s+/i);
+  for (const part of andParts) {
+    const match = part.match(/^(\w+)\s*=\s*(.+)$/);
+    if (!match) {
+      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
+    }
+    const column = match[1];
+    const valueStr = match[2];
+    if (valueStr === undefined || column === undefined) {
+      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
+    }
+    const trimmed = valueStr.trim();
+    const isFullyQuoted = trimmed.length >= 2 && (trimmed.startsWith("'") && trimmed.endsWith("'") || trimmed.startsWith('"') && trimmed.endsWith('"'));
+    if (!isFullyQuoted && /\s+AND\s*$/i.test(trimmed)) {
+      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
+    }
+    const stripped = isFullyQuoted ? trimmed.slice(1, -1) : trimmed;
+    let value = stripped;
+    if (stripped !== "" && !isNaN(Number(stripped))) {
+      value = Number(stripped);
+    }
+    if (stripped === "true")
+      value = true;
+    else if (stripped === "false")
+      value = false;
+    else if (stripped === "null")
+      value = null;
+    conditions[column] = value;
+  }
+  return conditions;
+}
+
+// src/core/mongo/dml-plan.ts
+function permissionSql(operation) {
+  if (operation === "insert")
+    return "INSERT INTO dummy";
+  if (operation === "update")
+    return "UPDATE dummy";
+  return "DELETE FROM dummy";
+}
+function broadOperation(operation) {
+  if (operation === "insert")
+    return "INSERT";
+  if (operation === "update")
+    return "UPDATE";
+  return "DELETE";
+}
+function pushFactor2(factors, code, severity, message) {
+  if (factors.some((f) => f.code === code && f.message === message))
+    return;
+  factors.push({ code, severity, message });
+}
+function decide2(factors) {
+  if (factors.some((f) => f.severity === "block"))
+    return "BLOCK";
+  if (factors.some((f) => f.severity === "warn"))
+    return "WARN";
+  return "ALLOW";
+}
+function classifyMongoUpdate(setDoc) {
+  const fields = new Set;
+  const tierFactors = [];
+  let hasBlock = false;
+  const hasAnyOperator = Object.keys(setDoc).some((k) => k.startsWith("$"));
+  if (!hasAnyOperator) {
+    for (const k of Object.keys(setDoc))
+      fields.add(k);
+    return { fields: Array.from(fields), tierFactors, hasBlock };
+  }
+  const seenTiers = new Map;
+  for (const [op, payload] of Object.entries(setDoc)) {
+    if (!op.startsWith("$")) {
+      fields.add(op);
+      continue;
+    }
+    if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+      for (const k of Object.keys(payload))
+        fields.add(k);
+    }
+    const tier = MONGO_OPERATOR_TIER[op];
+    if (tier === undefined) {
+      hasBlock = true;
+      tierFactors.push({
+        code: "mongo_unknown_operator",
+        severity: "block",
+        message: `Update uses unknown operator '${op}'. Reject by default; add to tier table if intentional.`
+      });
+      continue;
+    }
+    if (tier === "BLOCK") {
+      hasBlock = true;
+      tierFactors.push({
+        code: "mongo_unknown_operator",
+        severity: "block",
+        message: `Update uses '${op}' which executes server-side code. Operation rejected.`
+      });
+      continue;
+    }
+    if (tier === "SAFE")
+      continue;
+    const bucket = seenTiers.get(tier) ?? [];
+    bucket.push(op);
+    seenTiers.set(tier, bucket);
+  }
+  for (const [tier, ops] of seenTiers) {
+    if (tier === "RENAME") {
+      tierFactors.push({
+        code: "mongo_rename_operator",
+        severity: "warn",
+        message: `Update uses ${ops.join(", ")}; a renamed field keeps its value under a name the read mask does not know.`
+      });
+    } else if (tier === "ARITHMETIC") {
+      tierFactors.push({
+        code: "mongo_arithmetic_operator",
+        severity: "warn",
+        message: `Update uses ${ops.join(", ")}; numeric mutation may compound silently.`
+      });
+    } else if (tier === "ARRAY") {
+      tierFactors.push({
+        code: "mongo_array_operator",
+        severity: "warn",
+        message: `Update uses ${ops.join(", ")}; array mutation can grow unboundedly without a size guard.`
+      });
+    } else if (tier === "BITWISE") {
+      tierFactors.push({
+        code: "mongo_bitwise_operator",
+        severity: "warn",
+        message: `Update uses ${ops.join(", ")}; bitwise updates skip type promotion checks.`
+      });
+    }
+  }
+  return { fields: Array.from(fields), tierFactors, hasBlock };
+}
+function hasIdEquality(where) {
+  if (!("_id" in where))
+    return false;
+  const value = where._id;
+  if (value === null || value === undefined)
+    return false;
+  if (typeof value === "object")
+    return false;
+  return true;
+}
+function hasNonIdEquality(where) {
+  for (const [key, value] of Object.entries(where)) {
+    if (key === "_id")
+      continue;
+    if (key.startsWith("$"))
+      continue;
+    if (value === null)
+      continue;
+    if (typeof value === "object")
+      continue;
+    return true;
+  }
+  return false;
+}
+function hasBroadFilter(where) {
+  for (const [key, value] of Object.entries(where)) {
+    if (MONGO_BROAD_FILTER_OPERATORS.has(key))
+      return true;
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const inner of Object.keys(value)) {
+        if (MONGO_BROAD_FILTER_OPERATORS.has(inner))
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function applyPermission(operation, context, factors) {
+  const permResult = checkPermission(permissionSql(operation), context.permission);
+  if (!permResult.allowed) {
+    pushFactor2(factors, "permission_denied", "block", permResult.reason);
+  }
+}
+function applyTableBlacklist(target, context, factors) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
+    pushFactor2(factors, "table_blacklisted", "block", `Target collection ${target} is blacklisted.`);
+  }
+}
+function applyColumnBlacklist(target, fields, context, factors) {
+  const columns = context.blacklist.columns ?? {};
+  const lower = foldFieldPath(target);
+  let raw = [];
+  for (const [t2, cols] of Object.entries(columns)) {
+    if (foldFieldPath(t2) === lower) {
+      raw = cols;
+      break;
+    }
+  }
+  if (raw.length === 0)
+    return;
+  const { patterns, rejected } = compilePatterns(raw);
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    pushFactor2(factors, "blacklist_unreadable", "block", `blacklist.columns for '${target}' has entries this matcher cannot read: ${detail}`);
+    return;
+  }
+  if (patterns.length === 0)
+    return;
+  for (const field of fields) {
+    if (matchAny(field, patterns)) {
+      pushFactor2(factors, "blacklisted_column", "block", `MongoDB write would touch blacklisted path ${target}.${field}.`);
+    }
+  }
+}
+function applySchemaCoverage(target, context, factors) {
+  const schemaTables = Object.keys(context.schema);
+  if (schemaTables.length === 0) {
+    pushFactor2(factors, "schema_cache_missing", "warn", "Schema cache is missing for the selected connection.");
+    return;
+  }
+  const known = schemaTables.some((t2) => t2.toLowerCase() === target.toLowerCase());
+  if (!known) {
+    pushFactor2(factors, "schema_table_unknown", "warn", `Target collection ${target} is missing from schema cache.`);
+  }
+}
+function buildRecommendations2(factors) {
+  const out = new Set;
+  const codes = new Set(factors.map((f) => f.code));
+  if (codes.has("nonsql_filter_empty")) {
+    out.add("Add an _id equality filter before executing this MongoDB write.");
+  }
+  if (codes.has("nonsql_missing_id")) {
+    out.add("Prefer an _id equality filter before executing this MongoDB write.");
+  }
+  if (codes.has("nonsql_filter_broad")) {
+    out.add("Narrow the filter to an _id equality or a tightly bounded condition.");
+  }
+  if (codes.has("nonsql_unsupported_operator")) {
+    out.add("Restrict the update document to $set / $unset for planner-safe writes.");
+  }
+  if (codes.has("permission_denied")) {
+    out.add("Switch to a connection with sufficient permission only if the operation is intended.");
+  }
+  if (codes.has("table_blacklisted") || codes.has("blacklisted_column")) {
+    out.add("Review blacklist rules before accessing sensitive data.");
+  }
+  if (codes.has("schema_cache_missing") || codes.has("schema_table_unknown")) {
+    out.add("Refresh schema cache for the target collection before executing.");
+  }
+  out.add("Use --dry-run on the actual write command.");
+  return Array.from(out);
+}
+function buildSuggestedCommands2(target, factors) {
+  const codes = new Set(factors.map((f) => f.code));
+  if (codes.has("schema_cache_missing") || codes.has("schema_table_unknown")) {
+    return [`dbcli schema ${target} --format json`];
+  }
+  return [];
+}
+function flattenInsertPaths(data, prefix = "") {
+  const out = [];
+  for (const [k, v] of Object.entries(data)) {
+    const path2 = prefix === "" ? k : `${prefix}.${k}`;
+    out.push(path2);
+    if (v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date)) {
+      const ctor = v.constructor?.name;
+      if (ctor === "Object") {
+        out.push(...flattenInsertPaths(v, path2));
+      }
+    }
+  }
+  return out;
+}
+var MONGO_OPERATOR_TIER, MONGO_BROAD_FILTER_OPERATORS, analyzeMongoDmlRisk = (intent, context) => {
+  const factors = [];
+  applyPermission(intent.operation, context, factors);
+  applyTableBlacklist(intent.target, context, factors);
+  if (intent.operation === "insert") {
+    applyColumnBlacklist(intent.target, flattenInsertPaths(intent.data), context, factors);
+  } else if (intent.operation === "update") {
+    const cls = classifyMongoUpdate(intent.set);
+    for (const f of cls.tierFactors)
+      pushFactor2(factors, f.code, f.severity, f.message);
+    applyColumnBlacklist(intent.target, cls.fields, context, factors);
+    const where = intent.where ?? {};
+    if (Object.keys(where).length === 0) {
+      pushFactor2(factors, "nonsql_filter_empty", "block", "MongoDB update filter is empty and would match every document.");
+    } else if (!hasIdEquality(where)) {
+      if (hasBroadFilter(where)) {
+        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB update filter uses a broad operator and may match multiple documents.");
+      } else if (hasNonIdEquality(where)) {
+        pushFactor2(factors, "nonsql_missing_id", "warn", "MongoDB update filter does not use _id and may match multiple documents.");
+      } else {
+        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB update filter is not an _id equality and may match multiple documents.");
+      }
+    }
+  } else {
+    const where = intent.where ?? {};
+    if (Object.keys(where).length === 0) {
+      pushFactor2(factors, "nonsql_filter_empty", "block", "MongoDB delete filter is empty and would match every document.");
+    } else if (!hasIdEquality(where)) {
+      if (hasBroadFilter(where)) {
+        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB delete filter uses a broad operator and may match multiple documents.");
+      } else if (hasNonIdEquality(where)) {
+        pushFactor2(factors, "nonsql_missing_id", "warn", "MongoDB delete filter does not use _id and may match multiple documents.");
+      } else {
+        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB delete filter is not an _id equality and may match multiple documents.");
+      }
+    }
+  }
+  applySchemaCoverage(intent.target, context, factors);
+  return {
+    decision: decide2(factors),
+    operation: broadOperation(intent.operation),
+    targetTables: [intent.target],
+    riskFactors: factors,
+    recommendations: buildRecommendations2(factors),
+    suggestedCommands: buildSuggestedCommands2(intent.target, factors)
+  };
+};
+var init_dml_plan = __esm(() => {
+  init_blacklist_fold();
+  init_path_matcher();
+  init_permission_guard();
+  MONGO_OPERATOR_TIER = {
+    $set: "SAFE",
+    $unset: "SAFE",
+    $rename: "RENAME",
+    $inc: "ARITHMETIC",
+    $mul: "ARITHMETIC",
+    $min: "ARITHMETIC",
+    $max: "ARITHMETIC",
+    $currentDate: "ARITHMETIC",
+    $push: "ARRAY",
+    $pull: "ARRAY",
+    $pullAll: "ARRAY",
+    $pop: "ARRAY",
+    $addToSet: "ARRAY",
+    $bit: "BITWISE",
+    $where: "BLOCK"
+  };
+  MONGO_BROAD_FILTER_OPERATORS = new Set([
+    "$regex",
+    "$in",
+    "$nin",
+    "$gt",
+    "$gte",
+    "$lt",
+    "$lte",
+    "$ne",
+    "$exists",
+    "$or",
+    "$and",
+    "$nor",
+    "$not",
+    "$expr",
+    "$text"
+  ]);
+});
+
 // src/core/dml-plan-sql.ts
 function assertIdentifier(value, role) {
   if (!value || !IDENTIFIER_RE.test(value)) {
@@ -26851,359 +27862,6 @@ var init_dml_plan_sql = __esm(() => {
   IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 });
 
-// src/utils/where-parser.ts
-function parseWhereClause(whereClause) {
-  if (!whereClause || whereClause.trim() === "") {
-    throw new Error("WHERE clause cannot be empty");
-  }
-  const conditions = {};
-  const andParts = whereClause.split(/\s+AND\s+/i);
-  for (const part of andParts) {
-    const match = part.match(/^(\w+)\s*=\s*(.+)$/);
-    if (!match) {
-      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
-    }
-    const column = match[1];
-    const valueStr = match[2];
-    if (valueStr === undefined || column === undefined) {
-      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
-    }
-    const trimmed = valueStr.trim();
-    const isFullyQuoted = trimmed.length >= 2 && (trimmed.startsWith("'") && trimmed.endsWith("'") || trimmed.startsWith('"') && trimmed.endsWith('"'));
-    if (!isFullyQuoted && /\s+AND\s*$/i.test(trimmed)) {
-      throw new Error(`Cannot parse WHERE clause: "${part}". Use format "column=value" or "col1=val1 AND col2=val2"`);
-    }
-    const stripped = isFullyQuoted ? trimmed.slice(1, -1) : trimmed;
-    let value = stripped;
-    if (stripped !== "" && !isNaN(Number(stripped))) {
-      value = Number(stripped);
-    }
-    if (stripped === "true")
-      value = true;
-    else if (stripped === "false")
-      value = false;
-    else if (stripped === "null")
-      value = null;
-    conditions[column] = value;
-  }
-  return conditions;
-}
-
-// src/core/mongo/dml-plan.ts
-function permissionSql(operation) {
-  if (operation === "insert")
-    return "INSERT INTO dummy";
-  if (operation === "update")
-    return "UPDATE dummy";
-  return "DELETE FROM dummy";
-}
-function broadOperation(operation) {
-  if (operation === "insert")
-    return "INSERT";
-  if (operation === "update")
-    return "UPDATE";
-  return "DELETE";
-}
-function pushFactor2(factors, code, severity, message) {
-  if (factors.some((f) => f.code === code && f.message === message))
-    return;
-  factors.push({ code, severity, message });
-}
-function decide2(factors) {
-  if (factors.some((f) => f.severity === "block"))
-    return "BLOCK";
-  if (factors.some((f) => f.severity === "warn"))
-    return "WARN";
-  return "ALLOW";
-}
-function classifyMongoUpdate(setDoc) {
-  const fields = new Set;
-  const tierFactors = [];
-  let hasBlock = false;
-  const hasAnyOperator = Object.keys(setDoc).some((k) => k.startsWith("$"));
-  if (!hasAnyOperator) {
-    for (const k of Object.keys(setDoc))
-      fields.add(k);
-    return { fields: Array.from(fields), tierFactors, hasBlock };
-  }
-  const seenTiers = new Map;
-  for (const [op, payload] of Object.entries(setDoc)) {
-    if (!op.startsWith("$")) {
-      fields.add(op);
-      continue;
-    }
-    if (payload && typeof payload === "object" && !Array.isArray(payload)) {
-      for (const k of Object.keys(payload))
-        fields.add(k);
-    }
-    const tier = MONGO_OPERATOR_TIER[op];
-    if (tier === undefined) {
-      hasBlock = true;
-      tierFactors.push({
-        code: "mongo_unknown_operator",
-        severity: "block",
-        message: `Update uses unknown operator '${op}'. Reject by default; add to tier table if intentional.`
-      });
-      continue;
-    }
-    if (tier === "BLOCK") {
-      hasBlock = true;
-      tierFactors.push({
-        code: "mongo_unknown_operator",
-        severity: "block",
-        message: `Update uses '${op}' which executes server-side code. Operation rejected.`
-      });
-      continue;
-    }
-    if (tier === "SAFE")
-      continue;
-    const bucket = seenTiers.get(tier) ?? [];
-    bucket.push(op);
-    seenTiers.set(tier, bucket);
-  }
-  for (const [tier, ops] of seenTiers) {
-    if (tier === "RENAME") {
-      tierFactors.push({
-        code: "mongo_rename_operator",
-        severity: "warn",
-        message: `Update uses ${ops.join(", ")}; field rename does not exfiltrate data but can break readers.`
-      });
-    } else if (tier === "ARITHMETIC") {
-      tierFactors.push({
-        code: "mongo_arithmetic_operator",
-        severity: "warn",
-        message: `Update uses ${ops.join(", ")}; numeric mutation may compound silently.`
-      });
-    } else if (tier === "ARRAY") {
-      tierFactors.push({
-        code: "mongo_array_operator",
-        severity: "warn",
-        message: `Update uses ${ops.join(", ")}; array mutation can grow unboundedly without a size guard.`
-      });
-    } else if (tier === "BITWISE") {
-      tierFactors.push({
-        code: "mongo_bitwise_operator",
-        severity: "warn",
-        message: `Update uses ${ops.join(", ")}; bitwise updates skip type promotion checks.`
-      });
-    }
-  }
-  return { fields: Array.from(fields), tierFactors, hasBlock };
-}
-function hasIdEquality(where) {
-  if (!("_id" in where))
-    return false;
-  const value = where._id;
-  if (value === null || value === undefined)
-    return false;
-  if (typeof value === "object")
-    return false;
-  return true;
-}
-function hasNonIdEquality(where) {
-  for (const [key, value] of Object.entries(where)) {
-    if (key === "_id")
-      continue;
-    if (key.startsWith("$"))
-      continue;
-    if (value === null)
-      continue;
-    if (typeof value === "object")
-      continue;
-    return true;
-  }
-  return false;
-}
-function hasBroadFilter(where) {
-  for (const [key, value] of Object.entries(where)) {
-    if (MONGO_BROAD_FILTER_OPERATORS.has(key))
-      return true;
-    if (value && typeof value === "object" && !Array.isArray(value)) {
-      for (const inner of Object.keys(value)) {
-        if (MONGO_BROAD_FILTER_OPERATORS.has(inner))
-          return true;
-      }
-    }
-  }
-  return false;
-}
-function applyPermission(operation, context, factors) {
-  const permResult = checkPermission(permissionSql(operation), context.permission);
-  if (!permResult.allowed) {
-    pushFactor2(factors, "permission_denied", "block", permResult.reason);
-  }
-}
-function applyTableBlacklist(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
-    pushFactor2(factors, "table_blacklisted", "block", `Target collection ${target} is blacklisted.`);
-  }
-}
-function applyColumnBlacklist(target, fields, context, factors) {
-  const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
-  let raw = [];
-  for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
-      raw = cols;
-      break;
-    }
-  }
-  if (raw.length === 0)
-    return;
-  const { patterns } = compilePatterns(raw);
-  if (patterns.length === 0)
-    return;
-  for (const field of fields) {
-    if (matchAny(field, patterns)) {
-      pushFactor2(factors, "blacklisted_column", "block", `MongoDB write would touch blacklisted path ${target}.${field}.`);
-    }
-  }
-}
-function applySchemaCoverage(target, context, factors) {
-  const schemaTables = Object.keys(context.schema);
-  if (schemaTables.length === 0) {
-    pushFactor2(factors, "schema_cache_missing", "warn", "Schema cache is missing for the selected connection.");
-    return;
-  }
-  const known = schemaTables.some((t2) => t2.toLowerCase() === target.toLowerCase());
-  if (!known) {
-    pushFactor2(factors, "schema_table_unknown", "warn", `Target collection ${target} is missing from schema cache.`);
-  }
-}
-function buildRecommendations2(factors) {
-  const out = new Set;
-  const codes = new Set(factors.map((f) => f.code));
-  if (codes.has("nonsql_filter_empty")) {
-    out.add("Add an _id equality filter before executing this MongoDB write.");
-  }
-  if (codes.has("nonsql_missing_id")) {
-    out.add("Prefer an _id equality filter before executing this MongoDB write.");
-  }
-  if (codes.has("nonsql_filter_broad")) {
-    out.add("Narrow the filter to an _id equality or a tightly bounded condition.");
-  }
-  if (codes.has("nonsql_unsupported_operator")) {
-    out.add("Restrict the update document to $set / $unset for planner-safe writes.");
-  }
-  if (codes.has("permission_denied")) {
-    out.add("Switch to a connection with sufficient permission only if the operation is intended.");
-  }
-  if (codes.has("table_blacklisted") || codes.has("blacklisted_column")) {
-    out.add("Review blacklist rules before accessing sensitive data.");
-  }
-  if (codes.has("schema_cache_missing") || codes.has("schema_table_unknown")) {
-    out.add("Refresh schema cache for the target collection before executing.");
-  }
-  out.add("Use --dry-run on the actual write command.");
-  return Array.from(out);
-}
-function buildSuggestedCommands2(target, factors) {
-  const codes = new Set(factors.map((f) => f.code));
-  if (codes.has("schema_cache_missing") || codes.has("schema_table_unknown")) {
-    return [`dbcli schema ${target} --format json`];
-  }
-  return [];
-}
-function flattenInsertPaths(data, prefix = "") {
-  const out = [];
-  for (const [k, v] of Object.entries(data)) {
-    const path2 = prefix === "" ? k : `${prefix}.${k}`;
-    out.push(path2);
-    if (v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date)) {
-      const ctor = v.constructor?.name;
-      if (ctor === "Object") {
-        out.push(...flattenInsertPaths(v, path2));
-      }
-    }
-  }
-  return out;
-}
-var MONGO_OPERATOR_TIER, MONGO_BROAD_FILTER_OPERATORS, analyzeMongoDmlRisk = (intent, context) => {
-  const factors = [];
-  applyPermission(intent.operation, context, factors);
-  applyTableBlacklist(intent.target, context, factors);
-  if (intent.operation === "insert") {
-    applyColumnBlacklist(intent.target, flattenInsertPaths(intent.data), context, factors);
-  } else if (intent.operation === "update") {
-    const cls = classifyMongoUpdate(intent.set);
-    for (const f of cls.tierFactors)
-      pushFactor2(factors, f.code, f.severity, f.message);
-    applyColumnBlacklist(intent.target, cls.fields, context, factors);
-    const where = intent.where ?? {};
-    if (Object.keys(where).length === 0) {
-      pushFactor2(factors, "nonsql_filter_empty", "block", "MongoDB update filter is empty and would match every document.");
-    } else if (!hasIdEquality(where)) {
-      if (hasBroadFilter(where)) {
-        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB update filter uses a broad operator and may match multiple documents.");
-      } else if (hasNonIdEquality(where)) {
-        pushFactor2(factors, "nonsql_missing_id", "warn", "MongoDB update filter does not use _id and may match multiple documents.");
-      } else {
-        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB update filter is not an _id equality and may match multiple documents.");
-      }
-    }
-  } else {
-    const where = intent.where ?? {};
-    if (Object.keys(where).length === 0) {
-      pushFactor2(factors, "nonsql_filter_empty", "block", "MongoDB delete filter is empty and would match every document.");
-    } else if (!hasIdEquality(where)) {
-      if (hasBroadFilter(where)) {
-        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB delete filter uses a broad operator and may match multiple documents.");
-      } else if (hasNonIdEquality(where)) {
-        pushFactor2(factors, "nonsql_missing_id", "warn", "MongoDB delete filter does not use _id and may match multiple documents.");
-      } else {
-        pushFactor2(factors, "nonsql_filter_broad", "warn", "MongoDB delete filter is not an _id equality and may match multiple documents.");
-      }
-    }
-  }
-  applySchemaCoverage(intent.target, context, factors);
-  return {
-    decision: decide2(factors),
-    operation: broadOperation(intent.operation),
-    targetTables: [intent.target],
-    riskFactors: factors,
-    recommendations: buildRecommendations2(factors),
-    suggestedCommands: buildSuggestedCommands2(intent.target, factors)
-  };
-};
-var init_dml_plan = __esm(() => {
-  init_permission_guard();
-  MONGO_OPERATOR_TIER = {
-    $set: "SAFE",
-    $unset: "SAFE",
-    $rename: "RENAME",
-    $inc: "ARITHMETIC",
-    $mul: "ARITHMETIC",
-    $min: "ARITHMETIC",
-    $max: "ARITHMETIC",
-    $currentDate: "ARITHMETIC",
-    $push: "ARRAY",
-    $pull: "ARRAY",
-    $pullAll: "ARRAY",
-    $pop: "ARRAY",
-    $addToSet: "ARRAY",
-    $bit: "BITWISE",
-    $where: "BLOCK"
-  };
-  MONGO_BROAD_FILTER_OPERATORS = new Set([
-    "$regex",
-    "$in",
-    "$nin",
-    "$gt",
-    "$gte",
-    "$lt",
-    "$lte",
-    "$ne",
-    "$exists",
-    "$or",
-    "$and",
-    "$nor",
-    "$not",
-    "$expr",
-    "$text"
-  ]);
-});
-
 // src/core/redis/dml-plan.ts
 function permissionSql2(operation) {
   if (operation === "insert")
@@ -27245,17 +27903,17 @@ function applyPermission2(operation, context, factors) {
   }
 }
 function applyTableBlacklist2(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
     pushFactor3(factors, "table_blacklisted", "block", `Redis key ${target} is blacklisted.`);
   }
 }
 function applyColumnBlacklist2(target, fields, context, factors) {
   const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
+  const lower = foldFieldPath(target);
   let blacklistedFields = [];
   for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
+    if (foldFieldPath(t2) === lower) {
       blacklistedFields = cols;
       break;
     }
@@ -27353,6 +28011,7 @@ var analyzeRedisDmlRisk = (intent, context) => {
   };
 };
 var init_dml_plan2 = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
 });
 
@@ -27402,17 +28061,17 @@ function applyPermission3(operation, context, factors) {
   }
 }
 function applyTableBlacklist3(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
     pushFactor4(factors, "table_blacklisted", "block", `Elasticsearch index ${target} is blacklisted.`);
   }
 }
 function applyColumnBlacklist3(target, fields, context, factors) {
   const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
+  const lower = foldFieldPath(target);
   let blacklistedFields = [];
   for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
+    if (foldFieldPath(t2) === lower) {
       blacklistedFields = cols;
       break;
     }
@@ -27495,6 +28154,7 @@ var analyzeElasticsearchDmlRisk = (intent, context) => {
   };
 };
 var init_dml_plan3 = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
 });
 
@@ -27665,7 +28325,7 @@ async function insertCommand(table, options, command) {
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       blacklistValidator.checkTableBlacklist("INSERT", table, []);
-      blacklistValidator.checkColumnBlacklistOnWrite(table, Object.keys(data), "INSERT");
+      blacklistValidator.checkColumnBlacklistOnWrite(table, flattenInsertPaths(data), "INSERT");
       const preview = `SET ${table} ... (Redis Insert)`;
       if (options.dryRun) {
         const output = {
@@ -27730,7 +28390,7 @@ async function insertCommand(table, options, command) {
       const blacklistManager = new BlacklistManager(config);
       const blacklistValidator = new BlacklistValidator(blacklistManager);
       blacklistValidator.checkTableBlacklist("INSERT", table, []);
-      blacklistValidator.checkColumnBlacklistOnWrite(table, Object.keys(data), "INSERT");
+      blacklistValidator.checkColumnBlacklistOnWrite(table, flattenInsertPaths(data), "INSERT");
       const preview = previewInsert(table, data);
       if (options.dryRun) {
         const output = {
@@ -27848,9 +28508,11 @@ var init_insert = __esm(() => {
   init_mutation_outcome();
   init_config();
   init_permission_guard();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_blacklist();
   init_config_path();
+  init_dml_plan();
   init_dml_plan4();
   init_integration_helper();
 });
@@ -28008,7 +28670,11 @@ async function updateCommand(table, options, command) {
       if (hasOperator) {
         const operators = updateDoc;
         for (const [op, payload] of Object.entries(operators)) {
-          if ((op === "$set" || op === "$unset") && payload && typeof payload === "object" && !Array.isArray(payload)) {
+          if (!op.startsWith("$")) {
+            writtenFields.add(op);
+            continue;
+          }
+          if (payload && typeof payload === "object" && !Array.isArray(payload)) {
             for (const k of Object.keys(payload))
               writtenFields.add(k);
           }
@@ -28169,6 +28835,7 @@ var init_update = __esm(() => {
   init_mutation_outcome();
   init_config();
   init_permission_guard();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_blacklist();
   init_config_path();
@@ -28468,6 +29135,7 @@ var init_delete = __esm(() => {
   init_mutation_outcome();
   init_config();
   init_permission_guard();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_blacklist();
   init_config_path();
@@ -28911,6 +29579,7 @@ var init_export = __esm(() => {
   init_config();
   init_prompts();
   init_config_path();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_applied_limit();
   init_integration_helper();
@@ -30147,6 +30816,7 @@ async function gatherContext(workspaceRoot, configPath, options = {}) {
 }
 var init_context = __esm(() => {
   init_config();
+  init_blacklist_manager();
   init_loader();
   init_snippet_paths();
   init_semantic();
@@ -31363,11 +32033,8 @@ function auditBlacklistPatterns(cfg) {
   }
   return { warnings };
 }
-function isValidTableNameForSystem(name, system) {
-  if (!isValidTableName(name))
-    return false;
-  const literalMatching = system === "postgresql" || system === "mysql" || system === "mariadb" || system === "mongodb";
-  return !(literalMatching && GLOB_CHARS.test(name));
+function isValidTableNameForSystem(name, _system) {
+  return isValidTableName(name);
 }
 function isValidTableName(name) {
   return VALID_TABLE_NAME.test(name);
@@ -31533,16 +32200,16 @@ function resolveBlacklistConfigPath(options, command) {
   }
   return DEFAULT_CONFIG_PATH;
 }
-var DEFAULT_CONFIG_PATH = ".dbcli", VALID_TABLE_NAME, VALID_COLUMN_NAME, GLOB_CHARS, blacklistCommand, tableCmd, columnCmd;
+var DEFAULT_CONFIG_PATH = ".dbcli", VALID_TABLE_NAME, VALID_COLUMN_NAME, blacklistCommand, tableCmd, columnCmd;
 var init_blacklist2 = __esm(() => {
   init_config_v2();
   init_esm();
   init_message_loader();
   init_config();
+  init_path_matcher();
   init_validation();
-  VALID_TABLE_NAME = /^[a-zA-Z0-9_.*?:@[\]-]+$/;
-  VALID_COLUMN_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-  GLOB_CHARS = /[*?[\]]/;
+  VALID_TABLE_NAME = /^[a-zA-Z0-9_.*?:@[\]\\-]+$/;
+  VALID_COLUMN_NAME = /^[a-zA-Z0-9_*?[\]\\-]+$/;
   blacklistCommand = new Command("blacklist").description(t("blacklist.description"));
   blacklistCommand.command("list").description(t("blacklist.list_title")).option("--config <path>", "Path to .dbcli config file").option("--format <type>", "Output format: text, json", "text").action(async (options, command) => {
     try {
@@ -31613,11 +32280,10 @@ async function checkAction(table, options) {
     const checker = new HealthChecker(adapter);
     const blacklistManager = new BlacklistManager(config);
     const blacklistedColumns = getBlacklistedColumnSet(blacklistManager);
-    const blacklistedTables = getBlacklistedTableSet(blacklistManager);
     const checkTypes = options.checks ? options.checks.split(",") : undefined;
     const sampleSize = parseInt(options.sample, 10) || 1e4;
     if (table) {
-      if (blacklistedTables.has(table.toLowerCase())) {
+      if (blacklistManager.isTableBlacklisted(table)) {
         throw new Error(`Table "${table}" is blacklisted`);
       }
       const schema = await adapter.getTableSchema(table);
@@ -31632,7 +32298,7 @@ async function checkAction(table, options) {
       const reports = [];
       const skipped = [];
       for (const t2 of tables) {
-        if (blacklistedTables.has(t2.name.toLowerCase())) {
+        if (blacklistManager.isTableBlacklisted(t2.name)) {
           skipped.push(`${t2.name} (blacklisted)`);
           continue;
         }
@@ -31708,16 +32374,13 @@ function getBlacklistedColumnSet(manager) {
   }
   return result;
 }
-function getBlacklistedTableSet(manager) {
-  const state = manager.state;
-  return state?.tables || new Set;
-}
 var ALLOWED_FORMATS6, checkCommand;
 var init_check = __esm(() => {
   init_esm();
   init_adapters();
   init_config();
   init_health_checker();
+  init_blacklist_manager();
   init_size_category();
   init_validation();
   init_connection_selector();
@@ -33594,9 +34257,8 @@ var init_proposals = __esm(() => {
 });
 
 // src/core/orm-drift/compare.ts
-function globToRegex2(glob) {
-  const escaped = glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
+function starOnlyGlob(glob) {
+  return glob.replace(/[?[\]\\]/g, "\\$&");
 }
 function tableMap(schema, defaultSchema) {
   const tables = new Map;
@@ -33630,7 +34292,7 @@ function compareNormalized(orm, db, opts) {
   const tableKeys = new Set([...ormTables.keys(), ...dbTables.keys()]);
   const extraDefaultIgnore = opts.extraDefaultIgnore ?? [];
   const defaultIgnore = [...DEFAULT_IGNORE, ...extraDefaultIgnore];
-  const ignorePatterns = opts.ignore.map(globToRegex2);
+  const ignorePatterns = opts.ignore;
   const targetLabel = opts.targetLabel ?? "database";
   const entries = [];
   for (const tableKey of tableKeys) {
@@ -33641,7 +34303,7 @@ function compareNormalized(orm, db, opts) {
       continue;
     const table = qualifiedTableName(normalizedTable.identity);
     const isDefaultIgnored = defaultIgnore.includes(normalizedTable.identity.table);
-    if (isDefaultIgnored || ignorePatterns.some((pattern) => pattern.test(table))) {
+    if (isDefaultIgnored || ignorePatterns.some((pattern) => globMatches(starOnlyGlob(pattern), table))) {
       entries.push(entryWithProposals({
         category: "unmanaged",
         severity: "info",
@@ -33823,6 +34485,7 @@ function compareIndexes(ormIndexes, dbIndexes, tableIdentity, table, ormSource,
 var DEFAULT_IGNORE, entryOrder = (left, right) => codePointOrder(left.table, right.table) || codePointOrder(left.object, right.object) || codePointOrder(left.category, right.category) || codePointOrder(left.detail, right.detail);
 var init_compare = __esm(() => {
   init_normalized_schema();
+  init_glob();
   init_proposals();
   DEFAULT_IGNORE = ["_prisma_migrations"];
 });
@@ -34719,7 +35382,7 @@ function shouldEmbedRecent(opts) {
   return opts.forAgent === true || opts.format === "json";
 }
 function briefifyForRecent(entry) {
-  const phase = entry.metadata?.es_shell_phase;
+  const phase = entry.metadata?.shell_phase;
   return {
     id: entry.id,
     ts: entry.ts,
@@ -34813,7 +35476,10 @@ async function collectInspect(opts) {
   let version = null;
   if (!opts.noConnect && config?.connection && system) {
     const probeTimeout = opts.probeTimeoutMs ?? DEFAULT_PROBE_MS;
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter({
+      ...config,
+      blacklist: config.blacklist ?? { tables: [], columns: {} }
+    });
     let probeError = null;
     const probe = (async () => {
       await adapter.connect();
@@ -35207,8 +35873,12 @@ async function runDiagnostic(input) {
     description: meta.description ?? ""
   };
   let prepared;
+  let redisTokens = [];
   try {
     prepared = prepareExecution(input.snippet, { engine: input.engine, noLimit: false }, {}, {});
+    if (engineFamily(input.engine) === "redis") {
+      redisTokens = parseRedisCommand(prepared.rewrittenSql);
+    }
   } catch (err) {
     const reason = err instanceof SavedQueryError ? err.message : `prepare failed: ${err.message}`;
     return { ...base, rowCount: 0, rows: [], status: "skipped", reason, durationMs: 0 };
@@ -35216,7 +35886,7 @@ async function runDiagnostic(input) {
   const family = engineFamily(input.engine);
   const referencedTables = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
     ...ENGINE_DIALECT2[input.engine] ? { dialect: ENGINE_DIALECT2[input.engine] } : {}
-  }) : family === "es" && prepared.execHints?.index ? [prepared.execHints.index] : [];
+  }) : family === "es" && prepared.execHints?.index ? [prepared.execHints.index] : family === "redis" && redisTokens.length > 0 ? redisCommandTargets(redisTokens[0], redisTokens.slice(1)) : [];
   if (input.blacklistValidator && referencedTables.length > 0) {
     try {
       input.blacklistValidator.checkTablesBlacklist("SELECT", referencedTables);
@@ -35228,7 +35898,7 @@ async function runDiagnostic(input) {
         rowCount: 0,
         rows: [],
         status: "skipped",
-        reason: err.message,
+        reason: family === "redis" ? "Redis diagnostic skipped by blacklist" : err.message,
         durationMs: 0
       };
     }
@@ -35244,8 +35914,8 @@ async function runDiagnostic(input) {
   try {
     outcome = await Promise.race([exec, timer]);
   } catch (err) {
-    outcome = "error";
-    errorMessage2 = err.message;
+    outcome = err instanceof BlacklistRejection ? "skipped" : "error";
+    errorMessage2 = err instanceof BlacklistRejection ? "Redis diagnostic skipped by blacklist" : err.message;
   }
   const durationMs = Math.round(performance.now() - start);
   if (outcome === "timeout") {
@@ -35258,12 +35928,12 @@ async function runDiagnostic(input) {
       durationMs
     };
   }
-  if (outcome === "error") {
+  if (outcome === "error" || outcome === "skipped") {
     return {
       ...base,
       rowCount: 0,
       rows: [],
-      status: "error",
+      status: outcome,
       reason: errorMessage2 ?? "unknown error",
       durationMs
     };
@@ -35283,6 +35953,9 @@ async function runDiagnostic(input) {
 }
 var ENGINE_DIALECT2;
 var init_run_diagnostic = __esm(() => {
+  init_redis_adapter();
+  init_blacklist_enforcer();
+  init_types3();
   init_saved_queries();
   init_strategies();
   init_sql_tables();
@@ -35346,7 +36019,7 @@ async function collectReport(opts) {
     warnings.push({ severity: "warn", message: "connection config missing after probe" });
     return finalize({ context, sections: [], warnings, generatedAt });
   }
-  const adapter = AdapterFactory.createAdapter(config.connection);
+  const adapter = AdapterFactory.createAdapter(config);
   const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
   const sectionEvidence = new Map;
   for (const id of sections)
@@ -35426,6 +36099,7 @@ var init_collector2 = __esm(() => {
   init_saved_queries();
   init_select_snippets();
   init_run_diagnostic();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_section_map();
   init_types7();
@@ -37431,7 +38105,7 @@ function parseTailN(raw) {
   return requested;
 }
 function briefify(entry) {
-  const phase = entry.metadata?.es_shell_phase;
+  const phase = entry.metadata?.shell_phase;
   return {
     ts: entry.ts,
     command: entry.command,
@@ -37486,8 +38160,8 @@ function renderTailAllTable(envelopes) {
 }
 function briefifyShow(entry) {
   const { metadata, redacted_query, ...rest } = entry;
-  const phase = metadata?.es_shell_phase;
-  return phase === undefined ? rest : { ...rest, metadata: { es_shell_phase: phase } };
+  const phase = metadata?.shell_phase;
+  return phase === undefined ? rest : { ...rest, metadata: { shell_phase: phase } };
 }
 function renderEntryTable(entry) {
   const lines = [];
@@ -38234,6 +38908,7 @@ async function collectElasticsearchDoctorResults(config, runtimeOverrides = {})
 var ALLOWED_FORMATS15, SENSITIVE_PATTERNS, runDoctorChecks, defaultDoctorCollectorRuntime, doctorCommand;
 var init_doctor = __esm(() => {
   init_esm();
+  init_blacklist_fold();
   init_colors();
   init_config();
   init_adapters();
@@ -38350,7 +39025,8 @@ var init_doctor = __esm(() => {
         for (const col of columns) {
           const colLower = col.toLowerCase();
           const isSensitive = SENSITIVE_PATTERNS.some((p) => colLower.includes(p));
-          if (isSensitive && !blacklisted.has(col)) {
+          const foldedRules = new Set([...blacklisted].map(foldFieldPath));
+          if (isSensitive && !foldedRules.has(foldFieldPath(col))) {
             unprotected.push(`${table}.${col}`);
           }
         }
@@ -42015,6 +42691,7 @@ var init_snapshot = __esm(() => {
   init_config();
   init_config_path();
   init_validation();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_query_executor();
   init_permission_guard();
@@ -42683,6 +43360,7 @@ var init_assert = __esm(() => {
   init_config();
   init_config_path();
   init_validation();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_query_executor();
   init_saved_queries();
@@ -44861,6 +45539,7 @@ var init_verify2 = __esm(() => {
   init_adapters();
   init_config();
   init_config_path();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_query_executor();
   init_query_risk_analyzer();
@@ -45612,15 +46291,17 @@ class ReplEngine {
   adapter;
   context;
   writeGate;
+  auditSink;
   state;
   buffer;
   history;
   formatter;
   config;
-  constructor(adapter, context, historyPath, config = null, writeGate = null) {
+  constructor(adapter, context, historyPath, config = null, writeGate = null, auditSink = null) {
     this.adapter = adapter;
     this.context = context;
     this.writeGate = writeGate;
+    this.auditSink = auditSink;
     this.state = { format: "table", timing: false, connected: true, noLimit: false };
     this.buffer = new MultilineBuffer;
     this.history = new HistoryManager(historyPath);
@@ -45752,10 +46433,11 @@ class ReplEngine {
     } else {
       const permResult = checkPermission(sql, this.context.permission, SQL_DIALECTS.find((dialect) => dialect === this.context.system));
       if (!permResult.allowed) {
+        await this.auditSink?.({ phase: "outcome", success: false, statement: sql });
         return {
           action: "continue",
           output: import_picocolors3.default.red(t_vars("shell.error_permission", {
-            required: permResult.classification.type === "UNKNOWN" ? "admin" : "read-write",
+            required: permResult.requiredPermission ?? "admin",
             current: this.context.permission
           }))
         };
@@ -45771,18 +46453,22 @@ class ReplEngine {
       } catch (error) {
         if (!(error instanceof BlacklistError))
           throw error;
+        await this.auditSink?.({ phase: "outcome", success: false, statement: sql });
         return {
           action: "continue",
           output: import_picocolors3.default.red(t_vars("shell.error_blacklisted", { table: error.message }))
         };
       }
     }
-    if (this.writeGate && !await this.writeGate(sql))
+    if (this.writeGate && !await this.writeGate(sql)) {
+      await this.auditSink?.({ phase: "outcome", success: false, statement: sql });
       return { action: "continue" };
+    }
     return this.runStatement(sql, blacklistValidator, referencedTables);
   }
   async runStatement(sql, blacklistValidator, referencedTables) {
     const startTime = Date.now();
+    await this.auditSink?.({ phase: "attempt", success: true, statement: sql });
     try {
       const result = await this.adapter.execute(sql, undefined, {
         noLimit: this.state.noLimit
@@ -45808,6 +46494,7 @@ class ReplEngine {
 ` + import_picocolors3.default.dim(t_vars("shell.timing_display", { ms: String(elapsed) }));
       }
       this.state = { ...this.state, connected: true };
+      await this.auditSink?.({ phase: "outcome", success: true, statement: sql });
       return { action: "continue", output };
     } catch (error) {
       if (this.isConnectionError(error) && this.state.connected) {
@@ -45819,12 +46506,14 @@ class ReplEngine {
           console.error(import_picocolors3.default.green(t("shell.error_reconnect_success")));
           return this.runStatement(sql, blacklistValidator, referencedTables);
         } catch (reconnectError) {
+          await this.auditSink?.({ phase: "outcome", success: false, statement: sql });
           return {
             action: "continue",
             output: import_picocolors3.default.red(t_vars("shell.error_reconnect_failed", { message: reconnectError.message }))
           };
         }
       }
+      await this.auditSink?.({ phase: "outcome", success: false, statement: sql });
       return {
         action: "continue",
         output: import_picocolors3.default.red(t_vars("shell.error_sql_failed", { message: error.message }))
@@ -45859,6 +46548,7 @@ var init_repl_engine = __esm(() => {
   init_query_result_formatter();
   init_message_loader();
   init_sql_tables();
+  init_blacklist_manager();
   init_blacklist_validator();
   init_blacklist();
   import_picocolors3 = __toESM(require_picocolors(), 1);
@@ -46146,30 +46836,25 @@ function findStrings(node) {
   return found;
 }
 function namesProtectedField(term, protectedFields) {
-  if (protectedFields.has(term))
-    return true;
-  const parts = term.split(".");
-  if (parts.length === 1)
-    return false;
-  for (let start = 0;start < parts.length; start += 1) {
-    for (let end = start + 1;end <= parts.length; end += 1) {
-      if (protectedFields.has(parts.slice(start, end).join(".")))
-        return true;
-    }
-  }
-  return false;
+  return reachesProtected(foldFieldPath(term), contiguousRulesFor(protectedFields));
+}
+function reachesProtected(folded, rules) {
+  return reachesProtectedPath(folded, rules);
 }
 function redactFields(node, fields, trail = []) {
+  return redactWithGlobs(node, contiguousRulesFor(fields), trail.flatMap((entry) => foldFieldPath(entry).split(".")));
+}
+function redactWithGlobs(node, rules, trail) {
   if (Array.isArray(node))
-    return node.map((item) => redactFields(item, fields, trail));
+    return node.map((item) => redactWithGlobs(item, rules, trail));
   if (node === null || typeof node !== "object")
     return node;
   const out = {};
   for (const [key, value] of Object.entries(node)) {
-    const path4 = [...trail, key];
-    if (namesProtectedField(path4.join("."), fields))
+    const path4 = [...trail, ...foldFieldPath(key).split(".")];
+    if (reachesProtectedSegments(path4, rules))
       continue;
-    out[key] = redactFields(value, fields, path4);
+    out[key] = redactWithGlobs(value, rules, path4);
   }
   return out;
 }
@@ -46222,7 +46907,9 @@ function assertNoBlacklistedIndexNamed(args) {
   }
 }
 function collectProtectedFields(blacklistColumns) {
-  return new Set(Object.values(blacklistColumns).flat().map((field) => field.trim()).filter((field) => field.length > 0));
+  const fields = new Set(Object.values(blacklistColumns).flat().map(normalizeBlacklistEntry).filter((field) => field.length > 0));
+  contiguousRulesFor(fields);
+  return fields;
 }
 function queryStringFieldTerms(query) {
   const CONSERVATIVE = /[\s,:()"'[\]{}]+/;
@@ -46264,6 +46951,9 @@ var init_es_shell_guards = __esm(() => {
   init_message_loader();
   init_es_index_target();
   init_elasticsearch();
+  init_blacklist_fold();
+  init_blacklist_manager();
+  init_path_matcher();
   UNSCOPED_METADATA_PREFIXES = ["_cat", "_cluster", "_nodes", "_license"];
   UNSCOPED_METADATA_WITHHELD = {
     _cluster: new Set(["state"]),
@@ -46400,7 +47090,7 @@ async function executeEsBlock(block2, session) {
         target: record4.target,
         sql: record4.statement,
         sideEffectTier: record4.tierOverride,
-        metadata: { es_shell_phase: record4.phase }
+        metadata: { shell_phase: record4.phase }
       })
     });
     console.log(JSON.stringify(res, null, 2));
@@ -46600,6 +47290,25 @@ var init_shell_write_gate = __esm(() => {
   init_write_gate_guard();
 });
 
+// src/commands/shell-audit-sink.ts
+var exports_shell_audit_sink = {};
+__export(exports_shell_audit_sink, {
+  createShellAuditSink: () => createShellAuditSink
+});
+function createShellAuditSink(options) {
+  const write = options.write ?? writeAuditEntryResult;
+  return async (record4) => {
+    return await write(options.config, "shell", { config: options.configPath }, {
+      success: record4.success,
+      sql: record4.statement,
+      metadata: { shell_phase: record4.phase }
+    });
+  };
+}
+var init_shell_audit_sink = __esm(() => {
+  init_integration_helper();
+});
+
 // src/commands/shell.ts
 var exports_shell = {};
 __export(exports_shell, {
@@ -46717,7 +47426,11 @@ async function runShell(options, configPath) {
     dialect,
     ask: asker.ask
   }) : null;
-  const engine = new ReplEngine(adapter, context, HISTORY_PATH, config, writeGate);
+  const auditSink = (await Promise.resolve().then(() => (init_shell_audit_sink(), exports_shell_audit_sink))).createShellAuditSink({
+    config,
+    configPath
+  });
+  const engine = new ReplEngine(adapter, context, HISTORY_PATH, config, writeGate, auditSink);
   const complete = createCompleter(context);
   console.error(import_picocolors5.default.bold(t_vars("shell.welcome", {
     system: config.connection.system,
@@ -47549,6 +48262,7 @@ var init_migrate = __esm(() => {
   init_ddl2();
   init_ddl_executor();
   init_mutation_confirm();
+  init_blacklist_manager();
   init_config_path();
   migrateCommand = new Command("migrate").description(t("migrate.description"));
   addExecOpts(migrateCommand.command("create <table>").description(t("migrate.create_description")).option("--column <spec...>", 'Column definitions (e.g., "id:serial:pk" "name:varchar(50):not-null")')).action(async (table, opts, command) => {
@@ -47851,7 +48565,9 @@ function envVarNameFor(connName, field) {
   const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return `DBCLI_${slug}_${field.toUpperCase()}`;
 }
-var init_config_v2_mutations = () => {};
+var init_config_v2_mutations = __esm(() => {
+  init_validation();
+});
 
 // src/core/env-file-writer.ts
 import { chmod as chmod2, mkdir as mkdir18, readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
@@ -48023,7 +48739,7 @@ async function verifyNewPassword(configPath, target, connectionName, password) {
   process.env[target.varName] = password;
   try {
     const config = await configModule.read(storagePath, connectionName);
-    const adapter = AdapterFactory.createAdapter({
+    const adapter = AdapterFactory.createAdapterWithoutRules({
       ...config.connection,
       password
     });
@@ -52231,6 +52947,9 @@ var init_data_access = __esm(() => {
 });
 
 // src/core/orm-drift/change-set.ts
+function starOnlyGlob2(glob) {
+  return glob.replace(/[?[\]\\]/g, "\\$&");
+}
 function normalizeProposedChanges(input) {
   validateInput(input);
   const gaps = [
@@ -52288,7 +53007,7 @@ function tableMap2(schema, defaultSchema, side) {
   return tables;
 }
 function ignoredTableKeys(input, declared, baseline, gaps) {
-  const patterns = [...DEFAULT_IGNORE2, ...input.ignore ?? []].map(globToRegex3);
+  const patterns = [...DEFAULT_IGNORE2, ...input.ignore ?? []];
   const ignored = new Set;
   for (const [side, tables] of [
     ["declared", declared],
@@ -52296,7 +53015,7 @@ function ignoredTableKeys(input, declared, baseline, gaps) {
   ]) {
     for (const [key, resolved] of tables) {
       const name = qualifiedTableName(resolved.identity);
-      if (!patterns.some((pattern) => pattern.test(name) || pattern.test(resolved.identity.table)))
+      if (!patterns.some((pattern) => globMatches(starOnlyGlob2(pattern), name) || globMatches(starOnlyGlob2(pattern), resolved.identity.table)))
         continue;
       if (ignored.has(key))
         continue;
@@ -52474,10 +53193,6 @@ function unparsedGaps(schema, side) {
     reason: entry.reason
   }));
 }
-function globToRegex3(glob) {
-  const escaped = glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
-}
 function gapOrder(left, right) {
   return codePointOrder5(left.side, right.side) || codePointOrder5(left.kind, right.kind) || codePointOrder5(left.location, right.location) || codePointOrder5(left.reason, right.reason);
 }
@@ -52493,6 +53208,7 @@ function codePointOrder5(left, right) {
 }
 var DEFAULT_IGNORE2, NormalizedChangeSetError;
 var init_change_set = __esm(() => {
+  init_glob();
   DEFAULT_IGNORE2 = ["_prisma_migrations"];
   NormalizedChangeSetError = class NormalizedChangeSetError extends Error {
     constructor(message) {