@carllee1983/dbcli 6.0.0 → 7.0.0

package/dist/cli-runtime.mjs

@@ -51,7 +51,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "6.0.0",
+    version: "7.0.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -183,7 +183,9 @@ var init_package = __esm(() => {
     },
     overrides: {
       "brace-expansion": "^5.0.9",
-      postcss: "^8.5.26"
+      browserslist: "^4.28.7",
+      postcss: "^8.5.26",
+      "postcss-selector-parser": "^6.1.3"
     }
   };
 });
@@ -9019,6 +9021,7 @@ var init_messages = __esm(() => {
       unsupported_lang: "Language '{lang}' not supported, using English",
       invalid_json: "Invalid JSON: {message}",
       table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
+      redis_target_blacklisted: "Redis command refused by blacklist",
       column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
       table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
       table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
@@ -9110,7 +9113,8 @@ Reference: {referencePath}`,
       columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
     },
     warnings: {
-      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'"
+      blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
+      redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
     },
     version: {
       unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
@@ -9337,6 +9341,7 @@ var init_messages2 = __esm(() => {
       unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
       invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
       table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
+      redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
       column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
       table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
       table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
@@ -9428,7 +9433,8 @@ var init_messages2 = __esm(() => {
       columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
     },
     warnings: {
-      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A"
+      blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
+      redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
     },
     version: {
       unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
@@ -11165,6 +11171,12 @@ var init_server_side_script = __esm(() => {
   ES_OPAQUE_BODY_KEYS = ["wrapper"];
 });
 
+// src/utils/case-fold.ts
+function foldCase(text2) {
+  const lowered = (text2.includes("\u0130") ? text2.replaceAll("\u0130", "i") : text2).toLowerCase();
+  return lowered.includes("\u03C2") ? lowered.replaceAll("\u03C2", "\u03C3") : lowered;
+}
+
 // src/utils/glob.ts
 function findClassEnd(glob, open2) {
   for (let i = open2 + 1;i < glob.length; i++) {
@@ -11185,15 +11197,18 @@ function isValidCharacterClass(body) {
     return false;
   }
 }
-function parseGlob(glob) {
-  const memo = parsedGlobs.get(glob);
+function parseGlob(glob, caseInsensitive) {
+  const key = `${caseInsensitive ? "i" : "c"}\x00${glob}`;
+  const memo = parsedGlobs.get(key);
   if (memo !== undefined)
     return memo;
-  const parsed = parseGlobUncached(glob);
-  parsedGlobs.set(glob, parsed);
+  const parsed = parseGlobUncached(glob, caseInsensitive);
+  if (parsedGlobs.size >= PARSED_GLOB_LIMIT)
+    parsedGlobs.clear();
+  parsedGlobs.set(key, parsed);
   return parsed;
 }
-function parseGlobUncached(glob) {
+function parseGlobUncached(glob, caseInsensitive) {
   const runs = [];
   let current = [];
   let leadingStar = false;
@@ -11208,7 +11223,9 @@ function parseGlobUncached(glob) {
     const c = glob[i];
     if (c === "\\" && i + 1 < glob.length) {
       trailingStar = false;
-      current.push({ kind: "literal", char: glob[++i] });
+      const escaped = String.fromCodePoint(glob.codePointAt(++i));
+      i += escaped.length - 1;
+      current.push(...literalToken(escaped, caseInsensitive));
       continue;
     }
     if (c === "*") {
@@ -11228,39 +11245,53 @@ function parseGlobUncached(glob) {
       const end = findClassEnd(glob, i);
       const body = end === -1 ? "" : glob.slice(i, end + 1);
       if (body !== "" && isValidCharacterClass(body)) {
-        current.push({ kind: "class", test: new RegExp(`^${body}$`, "s") });
+        current.push({
+          kind: "class",
+          test: new RegExp(`^${body}$`, caseInsensitive ? "si" : "s")
+        });
         i = end;
         continue;
       }
-      current.push({ kind: "literal", char: "[" });
+      current.push(...literalToken("[", caseInsensitive));
       continue;
     }
-    current.push({ kind: "literal", char: c });
+    const literal = String.fromCodePoint(glob.codePointAt(i));
+    i += literal.length - 1;
+    current.push(...literalToken(literal, caseInsensitive));
   }
   endRun();
   return { runs, leadingStar, trailingStar, anchored: !sawStar };
 }
-function runMatchesAt(run, text2, at) {
+function literalToken(codePoint, caseInsensitive) {
+  const folded = caseInsensitive ? foldCase(codePoint) : codePoint;
+  return folded.split("").map((unit) => ({ kind: "literal", char: unit }));
+}
+function runMatchesAt(run, text2, raw, at) {
   if (at + run.length > text2.length)
     return false;
   for (let i = 0;i < run.length; i++) {
     const token = run[i];
-    const ch = text2[at + i];
     if (token.kind === "literal") {
-      if (token.char !== ch)
+      if (token.char !== text2[at + i])
         return false;
     } else if (token.kind === "class") {
-      if (!token.test.test(ch))
+      const rawChar = raw[at + i];
+      if (rawChar === undefined) {
+        throw new Error("globMatches: folded and unfolded subject lengths disagree");
+      }
+      if (!token.test.test(rawChar))
         return false;
     }
   }
   return true;
 }
-function globMatches(glob, text2) {
-  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob);
+function globMatches(glob, subject, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob, caseInsensitive);
+  const text2 = caseInsensitive ? foldCase(subject) : subject;
   if (anchored) {
     const run = runs[0] ?? [];
-    return text2.length === run.length && runMatchesAt(run, text2, 0);
+    return text2.length === run.length && runMatchesAt(run, text2, subject, 0);
   }
   if (runs.length === 0)
     return true;
@@ -11269,7 +11300,7 @@ function globMatches(glob, text2) {
   let last = runs.length;
   if (!leadingStar) {
     const head = runs[0];
-    if (!runMatchesAt(head, text2, 0))
+    if (!runMatchesAt(head, text2, subject, 0))
       return false;
     cursor = head.length;
     first = 1;
@@ -11277,7 +11308,7 @@ function globMatches(glob, text2) {
   if (!trailingStar) {
     const tail = runs[last - 1];
     const at = text2.length - tail.length;
-    if (at < cursor || !runMatchesAt(tail, text2, at))
+    if (at < cursor || !runMatchesAt(tail, text2, subject, at))
       return false;
     last -= 1;
   }
@@ -11286,7 +11317,7 @@ function globMatches(glob, text2) {
     const run = runs[r];
     let found = -1;
     for (let at = cursor;at + run.length <= limit; at++) {
-      if (runMatchesAt(run, text2, at)) {
+      if (runMatchesAt(run, text2, subject, at)) {
         found = at;
         break;
       }
@@ -11297,6 +11328,9 @@ function globMatches(glob, text2) {
   }
   return true;
 }
+function isGlobPattern(value) {
+  return /[*?[\\]/.test(value);
+}
 function escapeGlob(literal) {
   return literal.replace(/[*?[\]\\]/g, "\\$&");
 }
@@ -11322,11 +11356,17 @@ function globNeverMatches(glob) {
   }
   return null;
 }
-var parsedGlobs;
+var parsedGlobs, PARSED_GLOB_LIMIT = 4096;
 var init_glob = __esm(() => {
   parsedGlobs = new Map;
 });
 
+// src/core/blacklist-fold.ts
+function foldFieldPath(path) {
+  return foldCase(path);
+}
+var init_blacklist_fold = () => {};
+
 // src/core/mongo/path-matcher.ts
 function compilePatterns(raw) {
   const patterns = [];
@@ -11364,6 +11404,9 @@ function compilePatterns(raw) {
   }
   return { patterns, rejected };
 }
+function matchSegment(pattern, segment) {
+  return globMatches(pattern, segment, FOLD_CASE);
+}
 function matchAny(path, patterns) {
   if (patterns.length === 0)
     return false;
@@ -11378,7 +11421,7 @@ function matchAny(path, patterns) {
     }
     let ok = true;
     for (let i = 0;i < pat.segments.length; i++) {
-      if (!globMatches(pat.segments[i], pathSegments[i])) {
+      if (!globMatches(pat.segments[i], pathSegments[i], FOLD_CASE)) {
         ok = false;
         break;
       }
@@ -11388,8 +11431,75 @@ function matchAny(path, patterns) {
   }
   return false;
 }
+function contiguousRules(literals, globs) {
+  const widths = new Set;
+  for (const rule of literals)
+    widths.add(rule.split(".").length);
+  return { literals, globs, literalWidths: [...widths].sort((a, b) => a - b) };
+}
+function reachesProtectedSegments(segments, rules) {
+  const { literals, globs, literalWidths } = rules;
+  const depth = segments.length;
+  for (let start = 0;start < depth; start++) {
+    for (const width of literalWidths) {
+      const end = start + width;
+      if (end > depth)
+        break;
+      const candidate = width === 1 ? segments[start] : segments.slice(start, end).join(".");
+      if (literals.has(candidate))
+        return true;
+    }
+    for (const pattern of globs) {
+      const width = pattern.segments.length;
+      if (start + width > depth)
+        continue;
+      let matched = true;
+      for (let i = 0;i < width; i++) {
+        if (!matchSegment(pattern.segments[i], segments[start + i])) {
+          matched = false;
+          break;
+        }
+      }
+      if (matched)
+        return true;
+    }
+  }
+  return false;
+}
+function reachesProtectedPath(path, rules) {
+  return reachesProtectedSegments(path.split("."), rules);
+}
+function contiguousRulesFor(protectedFields) {
+  const memo = compiledRuleSets.get(protectedFields);
+  if (memo !== undefined)
+    return memo;
+  const globbed = [];
+  const literals = new Set;
+  for (const rule of protectedFields) {
+    if (isGlobPattern(rule))
+      globbed.push(rule);
+    else
+      literals.add(foldFieldPath(rule));
+  }
+  let globs = [];
+  if (globbed.length > 0) {
+    const compiled = compilePatterns(globbed);
+    if (compiled.rejected.length > 0) {
+      const detail = compiled.rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+      throw new Error(`BlacklistRejection: blacklist entries this matcher cannot read: ${detail}`);
+    }
+    globs = compiled.patterns;
+  }
+  const rules = contiguousRules(literals, globs);
+  compiledRuleSets.set(protectedFields, rules);
+  return rules;
+}
+var FOLD_CASE, compiledRuleSets;
 var init_path_matcher = __esm(() => {
   init_glob();
+  init_blacklist_fold();
+  FOLD_CASE = { caseInsensitive: true };
+  compiledRuleSets = new WeakMap;
 });
 
 // src/core/mongo/request-fields.ts
@@ -11400,40 +11510,10 @@ function asFieldPath(text2) {
     return text2.slice(1);
   return text2;
 }
-function globRulesOf(protectedFields) {
-  const globbed = [...protectedFields].filter((rule) => /[*?[\\]/.test(rule));
-  if (globbed.length === 0)
-    return [];
-  const { patterns, rejected } = compilePatterns(globbed);
-  if (rejected.length > 0) {
-    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
-    throw new Error(`BlacklistRejection: blacklist entries this matcher cannot read: ${detail}`);
-  }
-  return patterns;
-}
-function reachesProtectedField(path, protectedFields, globs) {
-  if (protectedFields.has(path))
-    return true;
-  if (globs.length > 0 && matchAny(path, globs))
-    return true;
-  const parts = path.split(".");
-  if (parts.length === 1)
-    return false;
-  for (let start = 0;start < parts.length; start += 1) {
-    for (let end = start + 1;end <= parts.length; end += 1) {
-      const candidate = parts.slice(start, end).join(".");
-      if (protectedFields.has(candidate))
-        return true;
-      if (globs.length > 0 && matchAny(candidate, globs))
-        return true;
-    }
-  }
-  return false;
-}
 function findProtectedFieldReference(request, protectedFields) {
   if (protectedFields.size === 0)
     return;
-  const globs = globRulesOf(protectedFields);
+  const rules = contiguousRulesFor(protectedFields);
   const candidates = [];
   let movesWholeDocument = false;
   const walk = (node) => {
@@ -11467,7 +11547,7 @@ function findProtectedFieldReference(request, protectedFields) {
     }
   };
   walk(request);
-  const named = candidates.find((path) => path.length > 0 && reachesProtectedField(path, protectedFields, globs));
+  const named = candidates.find((path) => path.length > 0 && reachesProtectedPath(foldFieldPath(path), rules));
   if (named !== undefined)
     return named;
   return movesWholeDocument ? [...protectedFields][0] : undefined;
@@ -11490,10 +11570,12 @@ function protectedFieldsForRequest(request, collection, columns) {
       collectStrings(value);
   };
   collectStrings(request);
-  const namedLower = new Set([...named].map((value) => value.toLowerCase()));
+  const namedFolded = new Set([...named].map(foldFieldPath));
+  const collectionFolded = foldFieldPath(collection);
   const fields = new Set;
   for (const [name, rules] of Object.entries(columns)) {
-    const applies = name.toLowerCase() === collection.toLowerCase() || namedLower.has(name.toLowerCase());
+    const folded = foldFieldPath(name);
+    const applies = folded === collectionFolded || namedFolded.has(folded);
     if (!applies)
       continue;
     for (const rule of rules) {
@@ -11507,6 +11589,7 @@ function protectedFieldsForRequest(request, collection, columns) {
 var WHOLE_DOCUMENT_VARIABLES, RESHAPES_DOCUMENT, NAMES_A_FIELD_DYNAMICALLY = "$getField";
 var init_request_fields = __esm(() => {
   init_path_matcher();
+  init_blacklist_fold();
   WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
   RESHAPES_DOCUMENT = new Set(["$objectToArray", "$replaceRoot", "$replaceWith"]);
 });
@@ -12493,6 +12576,15 @@ function sampleFromGlob(glob) {
   }
   return s;
 }
+function redisCommandTargets(command, args) {
+  const spec = getCommandSpec(command);
+  if (!spec)
+    return [];
+  return [
+    ...expandKeyArity(spec.keyArity, args, args.length).map((index) => args[index]).filter((key) => key !== undefined),
+    ...userPatterns(spec.keyArity, args)
+  ];
+}
 function checkKeyArgs(command, args, rules) {
   if (rules.length === 0)
     return { ok: true };
@@ -13421,6 +13513,180 @@ var init_elasticsearch_adapter = __esm(() => {
   init_server_side_script();
 });
 
+// src/core/blacklist-manager.ts
+function isBlacklistOverrideEnabled(value) {
+  return (value ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
+}
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (foldFieldPath(column.slice(0, dot)) !== foldFieldPath(tableKey))
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
+class BlacklistManager {
+  config;
+  state;
+  overrideEnabled;
+  rawTables = [];
+  constructor(config, overrideEnvValue) {
+    this.config = config;
+    this.overrideEnabled = isBlacklistOverrideEnabled(overrideEnvValue);
+    this.state = this.loadBlacklist();
+    this.wildcardTables = this.rawTables.filter(isGlobPattern);
+  }
+  loadBlacklist() {
+    this.rawTables.length = 0;
+    const tables = new Set;
+    const columns = new Map;
+    const blacklistConfig = this.config.blacklist;
+    if (!blacklistConfig) {
+      return { tables, columns };
+    }
+    if (Array.isArray(blacklistConfig.tables)) {
+      for (const tableName of blacklistConfig.tables) {
+        if (typeof tableName === "string") {
+          const entry = normalizeBlacklistEntry(tableName);
+          this.rawTables.push(entry);
+          tables.add(foldFieldPath(entry));
+        } else {
+          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
+        }
+      }
+    } else if (blacklistConfig.tables !== undefined) {
+      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
+    }
+    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
+      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
+        if (typeof tableName !== "string") {
+          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
+          continue;
+        }
+        if (!Array.isArray(cols)) {
+          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
+          continue;
+        }
+        const columnSet = new Set;
+        for (const col of cols) {
+          if (typeof col === "string") {
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
+          } else {
+            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
+          }
+        }
+        if (columnSet.size > 0) {
+          columns.set(foldFieldPath(normalizeBlacklistEntry(tableName)), columnSet);
+        }
+      }
+    } else if (blacklistConfig.columns !== undefined) {
+      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
+    }
+    return { tables, columns };
+  }
+  isTableBlacklisted(tableName) {
+    const name = foldFieldPath(tableName);
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, tableName, { caseInsensitive: true }))
+        return true;
+    }
+    return false;
+  }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = foldFieldPath(normalizeBlacklistEntry(tableName));
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
+  }
+  isColumnBlacklisted(tableName, columnName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return false;
+    }
+    const target = foldFieldPath(normalizeBlacklistEntry(columnName));
+    const compiled = this.foldedColumnsFor(columnSet);
+    if (compiled.literals.has(target))
+      return true;
+    return compiled.globs.length > 0 && matchAny(target, compiled.globs);
+  }
+  foldedColumns = new WeakMap;
+  foldedColumnsFor(columnSet) {
+    const memo = this.foldedColumns.get(columnSet);
+    if (memo !== undefined)
+      return memo;
+    const literals = new Set;
+    const globbed = [];
+    for (const rule of columnSet) {
+      if (isGlobPattern(rule))
+        globbed.push(rule);
+      else
+        literals.add(foldFieldPath(rule));
+    }
+    const folded = {
+      literals,
+      globs: globbed.length > 0 ? compilePatterns(globbed).patterns : []
+    };
+    this.foldedColumns.set(columnSet, folded);
+    return folded;
+  }
+  getBlacklistedColumns(tableName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return [];
+    }
+    return Array.from(columnSet);
+  }
+  getAllBlacklistedColumns() {
+    const all = new Set;
+    for (const columnSet of this.state.columns.values()) {
+      for (const column of columnSet)
+        all.add(column);
+    }
+    return Array.from(all);
+  }
+  canOverrideBlacklist() {
+    return this.overrideEnabled;
+  }
+  getState() {
+    return this.state;
+  }
+}
+var init_blacklist_manager = __esm(() => {
+  init_glob();
+  init_blacklist_fold();
+  init_path_matcher();
+});
+
 // src/adapters/factory.ts
 class AdapterFactory {
   static createSqlAdapter(rawOptions) {
@@ -13435,7 +13701,7 @@ class AdapterFactory {
         throw new Error(`createSqlAdapter requires a SQL system, got: ${options.system}`);
     }
   }
-  static createQueryableAdapter(rawOptions) {
+  static createQueryableAdapterWithoutRules(rawOptions) {
     const options = withResolvedTimeout(rawOptions);
     switch (options.system) {
       case "mongodb":
@@ -13445,10 +13711,27 @@ class AdapterFactory {
       case "elasticsearch":
         return new ElasticsearchAdapter(options);
       default:
-        throw new Error(`createQueryableAdapter requires a non-SQL queryable system, got: ${options.system}`);
+        throw new Error(`createQueryableAdapterWithoutRules requires a non-SQL queryable system, got: ${options.system}`);
     }
   }
-  static createAdapter(options) {
+  static createAdapter(config) {
+    const options = config.connection;
+    switch (options.system) {
+      case "postgresql":
+      case "mysql":
+      case "mariadb":
+        return AdapterFactory.createSqlAdapter(options);
+      case "redis":
+        return AdapterFactory.createRedisAdapter(config);
+      case "mongodb":
+        return AdapterFactory.createMongoDBAdapter(config);
+      case "elasticsearch":
+        return AdapterFactory.createElasticsearchAdapter(options);
+      default:
+        throw new Error(`Unsupported database system: ${options.system}`);
+    }
+  }
+  static createAdapterWithoutRules(options) {
     switch (options.system) {
       case "postgresql":
       case "mysql":
@@ -13457,7 +13740,7 @@ class AdapterFactory {
       case "mongodb":
       case "redis":
       case "elasticsearch":
-        return AdapterFactory.createQueryableAdapter(options);
+        return AdapterFactory.createQueryableAdapterWithoutRules(options);
       default:
         throw new Error(`Unsupported database system: ${options.system}`);
     }
@@ -13467,7 +13750,7 @@ class AdapterFactory {
     if (options.system !== "mongodb") {
       throw new Error("createMongoDBAdapter requires system: mongodb");
     }
-    const adapter = AdapterFactory.createQueryableAdapter(options);
+    const adapter = AdapterFactory.createQueryableAdapterWithoutRules(options);
     adapter.setBlacklistColumns(config.blacklist?.columns ?? {});
     return adapter;
   }
@@ -13478,7 +13761,12 @@ class AdapterFactory {
     }
     const options = withResolvedTimeout(rawOptions);
     const adapter = new RedisAdapter(options);
-    adapter.setBlacklistRules(config.blacklist?.tables ?? []);
+    const blacklistRules = config.blacklist?.tables ?? [];
+    const overrideEnabled = isBlacklistOverrideEnabled();
+    if (overrideEnabled && blacklistRules.length > 0) {
+      console.error(t("warnings.redis_blacklist_override_active"));
+    }
+    adapter.setBlacklistRules(overrideEnabled ? [] : blacklistRules);
     adapter.setMaskRules(config.redis?.mask ?? []);
     return adapter;
   }
@@ -13486,7 +13774,7 @@ class AdapterFactory {
     if (options.system !== "elasticsearch") {
       throw new Error("createElasticsearchAdapter requires system: elasticsearch");
     }
-    return AdapterFactory.createQueryableAdapter(options);
+    return AdapterFactory.createQueryableAdapterWithoutRules(options);
   }
 }
 var init_factory = __esm(() => {
@@ -13495,6 +13783,8 @@ var init_factory = __esm(() => {
   init_mongodb_adapter();
   init_redis_adapter();
   init_elasticsearch_adapter();
+  init_blacklist_manager();
+  init_message_loader();
 });
 
 // src/adapters/index.ts
@@ -14109,7 +14399,7 @@ async function initCommandHandler(options, command) {
       password: String(resolveValue(newConfig.connection.password, "password")) || "",
       database: String(resolveValue(newConfig.connection.database, "database"))
     };
-    const adapter = AdapterFactory.createAdapter(testConnection);
+    const adapter = AdapterFactory.createAdapterWithoutRules(testConnection);
     try {
       await adapter.connect();
       const isHealthy = await adapter.testConnection();
@@ -16651,147 +16941,6 @@ class ColumnIndexBuilder {
     };
   }
 }
-// src/core/blacklist-manager.ts
-function normalizeBlacklistEntry(raw) {
-  const trimmed = raw.trim();
-  const quote = trimmed[0];
-  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
-    return trimmed.slice(1, -1).trim();
-  }
-  return trimmed;
-}
-function assertNotTableQualified(tableKey, column) {
-  const dot = column.indexOf(".");
-  if (dot <= 0)
-    return;
-  if (column.slice(0, dot).toLowerCase() !== tableKey.toLowerCase())
-    return;
-  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
-}
-
-class BlacklistManager {
-  config;
-  state;
-  overrideEnabled;
-  constructor(config, overrideEnvValue) {
-    this.config = config;
-    this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
-    this.state = this.loadBlacklist();
-    this.wildcardTables = [...this.state.tables].filter((entry) => /[*?[\\]/.test(entry));
-  }
-  loadBlacklist() {
-    const tables = new Set;
-    const columns = new Map;
-    const blacklistConfig = this.config.blacklist;
-    if (!blacklistConfig) {
-      return { tables, columns };
-    }
-    if (Array.isArray(blacklistConfig.tables)) {
-      for (const tableName of blacklistConfig.tables) {
-        if (typeof tableName === "string") {
-          tables.add(normalizeBlacklistEntry(tableName).toLowerCase());
-        } else {
-          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
-        }
-      }
-    } else if (blacklistConfig.tables !== undefined) {
-      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
-    }
-    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
-      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
-        if (typeof tableName !== "string") {
-          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
-          continue;
-        }
-        if (!Array.isArray(cols)) {
-          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
-          continue;
-        }
-        const columnSet = new Set;
-        for (const col of cols) {
-          if (typeof col === "string") {
-            const entry = normalizeBlacklistEntry(col);
-            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
-            columnSet.add(entry);
-          } else {
-            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
-          }
-        }
-        if (columnSet.size > 0) {
-          columns.set(normalizeBlacklistEntry(tableName).toLowerCase(), columnSet);
-        }
-      }
-    } else if (blacklistConfig.columns !== undefined) {
-      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
-    }
-    return { tables, columns };
-  }
-  isTableBlacklisted(tableName) {
-    const name = tableName.toLowerCase();
-    if (this.state.tables.has(name))
-      return true;
-    for (const pattern of this.wildcardTables) {
-      if (globMatches(pattern, name))
-        return true;
-    }
-    return false;
-  }
-  wildcardTables;
-  columnRulesFor(tableName) {
-    const key = normalizeBlacklistEntry(tableName).toLowerCase();
-    const direct = this.state.columns.get(key);
-    if (direct)
-      return direct;
-    const dot = key.lastIndexOf(".");
-    if (dot > 0) {
-      const bare = this.state.columns.get(key.slice(dot + 1));
-      if (bare)
-        return bare;
-    }
-    let merged;
-    for (const [ruleKey, columns] of this.state.columns) {
-      const ruleDot = ruleKey.lastIndexOf(".");
-      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
-        continue;
-      merged ??= new Set;
-      for (const column of columns)
-        merged.add(column);
-    }
-    return merged;
-  }
-  isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.columnRulesFor(tableName);
-    if (!columnSet) {
-      return false;
-    }
-    return columnSet.has(normalizeBlacklistEntry(columnName).toLowerCase());
-  }
-  getBlacklistedColumns(tableName) {
-    const columnSet = this.columnRulesFor(tableName);
-    if (!columnSet) {
-      return [];
-    }
-    return Array.from(columnSet);
-  }
-  getAllBlacklistedColumns() {
-    const all = new Set;
-    for (const columnSet of this.state.columns.values()) {
-      for (const column of columnSet)
-        all.add(column);
-    }
-    return Array.from(all);
-  }
-  canOverrideBlacklist() {
-    return this.overrideEnabled;
-  }
-  getState() {
-    return this.state;
-  }
-}
-var init_blacklist_manager = __esm(() => {
-  init_glob();
-});
-
 // src/types/blacklist.ts
 var BlacklistError;
 var init_blacklist = __esm(() => {
@@ -16855,18 +17004,138 @@ function projectRows(rows, selection) {
   const columnNames = collectColumnNames(projectedRows);
   return { rows: normalizeRows(projectedRows, columnNames), columnNames };
 }
-function hasFieldPath(row, segments) {
-  return readPath(row, segments).found;
+function hasFieldPath(row, segments, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const folded = caseInsensitive && options?.alreadyFolded !== true ? segments.map(foldCase) : segments;
+  return readPath(row, folded, caseInsensitive).found;
+}
+function narrow(rules, key) {
+  const parts = key.includes(".") ? key.split(".") : [key];
+  const live = [];
+  for (const rule of rules) {
+    const remaining = rule.segments.length;
+    if (remaining < parts.length && !rule.wildcardTail)
+      continue;
+    let matches = true;
+    for (let i = 0;i < Math.min(remaining, parts.length); i++) {
+      if (!matchSegment(rule.segments[i], parts[i])) {
+        matches = false;
+        break;
+      }
+    }
+    if (!matches)
+      continue;
+    if (remaining <= parts.length)
+      return { drop: true, live: [] };
+    live.push({
+      root: rule.root,
+      rootIndex: rule.rootIndex,
+      offset: rule.offset + parts.length,
+      segments: rule.segments.slice(parts.length),
+      wildcardTail: rule.wildcardTail
+    });
+  }
+  return { drop: false, live };
+}
+function liveRulesOf(patterns) {
+  return patterns.map((pattern, index) => ({
+    root: pattern,
+    rootIndex: index,
+    offset: 0,
+    segments: pattern.segments,
+    wildcardTail: pattern.wildcardTail
+  }));
 }
-function omitFieldPaths(rows, paths) {
-  const topLevel = new Set(paths);
-  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: path.slice(0, path.indexOf(".")), segments: path.split(".") }));
+
+class NarrowStates {
+  states = [];
+  ids = new Map;
+  transitions = new Map;
+  constructor(rules) {
+    this.intern(rules);
+  }
+  rules(state) {
+    const rules = this.states[state];
+    if (rules === undefined)
+      throw new Error(`unknown nested-rule state ${state}`);
+    return rules;
+  }
+  step(state, key) {
+    const memoKey = `${state}\x00${key}`;
+    const memo = this.transitions.get(memoKey);
+    if (memo !== undefined)
+      return memo;
+    const { drop, live } = narrow(this.rules(state), key);
+    const step = drop ? { drop: true } : { drop: false, next: this.intern(live) };
+    if (this.transitions.size >= NARROW_STATE_LIMIT)
+      this.transitions = new Map;
+    this.transitions.set(memoKey, step);
+    return step;
+  }
+  intern(rules) {
+    const key = rules.map((rule) => `${rule.rootIndex}:${rule.offset}`).join(",");
+    const existing = this.ids.get(key);
+    if (existing !== undefined)
+      return existing;
+    const id = this.states.length;
+    this.states.push(rules);
+    this.ids.set(key, id);
+    return id;
+  }
+}
+function collectNestedMatches(row, states, pending, onMatch) {
+  if (pending.size === 0)
+    return;
+  const walk = (value, state, depth) => {
+    if (pending.size === 0 || states.rules(state).length === 0)
+      return;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        walk(item, state, depth);
+      return;
+    }
+    if (!isPlainRecord(value))
+      return;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const step = states.step(state, key);
+      if (step.drop) {
+        if (depth > 0) {
+          for (const rule of states.rules(state)) {
+            if (!pending.has(rule.root))
+              continue;
+            if (!narrow([rule], key).drop)
+              continue;
+            pending.delete(rule.root);
+            onMatch(rule.root);
+          }
+        }
+        continue;
+      }
+      walk(value[key], step.next, depth + 1);
+    }
+  };
+  walk(row, 0, 0);
+}
+function compileNestedRules(patterns) {
+  return new NarrowStates(liveRulesOf(patterns));
+}
+function omitFieldPaths(rows, paths, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const nestedPatterns = options?.patterns ?? [];
+  const nestedStates = nestedPatterns.length > 0 ? compileNestedRules(nestedPatterns) : undefined;
+  const fold = (value) => caseInsensitive ? foldCase(value) : value;
+  const topLevel = new Set(paths.map(fold));
+  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: fold(path.slice(0, path.indexOf("."))), segments: path.split(".") }));
   const maskRecord = (row) => {
-    let projected = cloneRecord(row, topLevel);
+    let projected = cloneRecord(row, topLevel, caseInsensitive);
     for (const { head, segments } of dotted) {
-      const value = row[head];
-      if (value !== null && typeof value === "object")
-        projected = omitPath(projected, segments);
+      const value = headValue(row, head, caseInsensitive);
+      if (value !== null && typeof value === "object") {
+        projected = omitPath(projected, segments, caseInsensitive);
+      }
+    }
+    if (nestedStates !== undefined && hasNestedRecord(row)) {
+      projected = omitMatching(projected, nestedStates, 0);
     }
     return projected;
   };
@@ -16905,11 +17174,37 @@ function validatePath(path) {
   if (unsafe)
     throw new Error(`--fields contains an unsafe field segment: ${unsafe}`);
 }
-function readPath(value, segments) {
+function headValue(row, head, caseInsensitive) {
+  if (!caseInsensitive)
+    return row[head];
+  const key = foldedKeys(row).get(head);
+  return key === undefined ? undefined : row[key];
+}
+function foldedKeys(value) {
+  const memo = foldedKeyIndex.get(value);
+  if (memo !== undefined)
+    return memo;
+  const index = new Map;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    const folded = foldCase(key);
+    if (!index.has(folded))
+      index.set(folded, key);
+  }
+  foldedKeyIndex.set(value, index);
+  return index;
+}
+function ownKey(value, name, caseInsensitive) {
+  if (Object.prototype.hasOwnProperty.call(value, name))
+    return name;
+  if (!caseInsensitive)
+    return;
+  return foldedKeys(value).get(name);
+}
+function readPath(value, segments, caseInsensitive = false) {
   if (segments.length === 0)
     return { found: true, value };
   if (Array.isArray(value)) {
-    const results = value.map((item) => readPath(item, segments));
+    const results = value.map((item) => readPath(item, segments, caseInsensitive));
     return {
       found: results.some((result) => result.found),
       value: results.map((result) => result.found ? result.value : undefined)
@@ -16917,41 +17212,68 @@ function readPath(value, segments) {
   }
   if (!isRecord(value))
     return { found: false };
-  const exactPath = segments.join(".");
-  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
-    return { found: true, value: value[exactPath] };
-  }
+  const exact = ownKey(value, segments.join("."), caseInsensitive);
+  if (exact !== undefined)
+    return { found: true, value: value[exact] };
   const [head, ...tail] = segments;
-  if (!Object.prototype.hasOwnProperty.call(value, head))
+  const headKey = ownKey(value, head, caseInsensitive);
+  if (headKey === undefined)
     return { found: false };
-  return readPath(value[head], tail);
+  return readPath(value[headKey], tail, caseInsensitive);
 }
-function omitPath(value, segments) {
+function omitMatching(value, states, state) {
+  if (states.rules(state).length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitMatching(item, states, state));
+  if (!isPlainRecord(value))
+    return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const step = states.step(state, key);
+    if (step.drop)
+      continue;
+    defineData(out, key, omitMatching(child, states, step.next));
+  }
+  return out;
+}
+function hasNestedRecord(row) {
+  for (const key of Object.getOwnPropertyNames(row)) {
+    const value = row[key];
+    if (Array.isArray(value) || isPlainRecord(value))
+      return true;
+  }
+  return false;
+}
+function omitPath(value, segments, caseInsensitive) {
   if (segments.length === 0)
     return value;
   if (Array.isArray(value))
-    return value.map((item) => omitPath(item, segments));
+    return value.map((item) => omitPath(item, segments, caseInsensitive));
   if (!isPlainRecord(value))
     return value;
-  const exactPath = segments.join(".");
-  const [head, ...tail] = segments;
+  const fold = (name) => caseInsensitive ? foldCase(name) : name;
+  const exactPath = fold(segments.join("."));
+  const head = fold(segments[0]);
+  const tail = segments.slice(1);
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (key === exactPath)
+    const folded = fold(key);
+    if (folded === exactPath)
       continue;
-    if (key === head) {
+    if (folded === head) {
       if (tail.length > 0)
-        defineData(out, key, omitPath(child, tail));
+        defineData(out, key, omitPath(child, tail, caseInsensitive));
       continue;
     }
     defineData(out, key, child);
   }
   return out;
 }
-function cloneRecord(value, omittedKeys) {
+function cloneRecord(value, omittedKeys, caseInsensitive = false) {
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (!omittedKeys.has(key))
+    if (!omittedKeys.has(caseInsensitive ? foldCase(key) : key))
       defineData(out, key, child);
   }
   return out;
@@ -16996,9 +17318,11 @@ function defineData(target, key, value) {
     writable: true
   });
 }
-var UNSAFE_SEGMENTS;
+var UNSAFE_SEGMENTS, NARROW_STATE_LIMIT = 4096, foldedKeyIndex;
 var init_field_projection = __esm(() => {
+  init_path_matcher();
   UNSAFE_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+  foldedKeyIndex = new WeakMap;
 });
 
 // src/utils/es-index-target.ts
@@ -17065,16 +17389,16 @@ function expandIndexTargets(target) {
   return { concrete, wildcards };
 }
 function matchesIndexGlob(pattern, name) {
-  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
+  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern;
   try {
-    return globMatches(normalized, name.toLowerCase());
+    return globMatches(normalized, name, { caseInsensitive: true });
   } catch {
     return true;
   }
 }
 function reachesByConvention(name, entry) {
-  const lower = name.toLowerCase();
-  const target = entry.toLowerCase();
+  const lower = foldFieldPath(name);
+  const target = foldFieldPath(entry);
   return new RegExp(`^\\.ds-${escapeRegExp(target)}-`).test(lower) || new RegExp(`^${escapeRegExp(target)}-\\d+$`).test(lower);
 }
 function escapeRegExp(text2) {
@@ -17095,11 +17419,12 @@ function indexExpressionReaches(expression, blacklisted) {
     return false;
   const { concrete, wildcards } = expandIndexTargets(expression);
   const entries = expandBlacklistEntries(blacklisted);
-  const reachesName = (name) => entries.names.some((entry) => entry.toLowerCase() === name.toLowerCase() || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
+  const reachesName = (name) => entries.names.some((entry) => foldFieldPath(entry) === foldFieldPath(name) || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
   return concrete.some(reachesName) || wildcards.some((pattern) => entries.names.some((entry) => matchesIndexGlob(pattern, entry)) || entries.patterns.length > 0);
 }
 var MAX_DECODE_PASSES = 4;
 var init_es_index_target = __esm(() => {
+  init_blacklist_fold();
   init_glob();
 });
 
@@ -17118,7 +17443,7 @@ function dedupe2(values) {
   const seen = new Set;
   const result = [];
   for (const value of values) {
-    const key = value.toLowerCase();
+    const key = foldFieldPath(value);
     if (value.length === 0 || seen.has(key))
       continue;
     seen.add(key);
@@ -17126,11 +17451,14 @@ function dedupe2(values) {
   }
   return result;
 }
-function compileGlobRules(rules, fold, table, operation) {
-  const globbed = rules.filter((rule) => /[*?[\\]/.test(rule));
+function omittedByName(omittedColumns, path) {
+  return omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`));
+}
+function compileGlobRules(rules, table, operation) {
+  const globbed = rules.filter(isGlobPattern);
   if (globbed.length === 0)
     return [];
-  const { patterns, rejected } = compilePatterns(globbed.map(fold));
+  const { patterns, rejected } = compilePatterns(globbed);
   if (rejected.length > 0) {
     const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
     throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
@@ -17194,10 +17522,10 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const protectedPaths = new Set(blacklisted.map((name) => name.toLowerCase()));
-    const globs = compileGlobRules(blacklisted, (value) => value.toLowerCase(), tableName, operation);
+    const protectedPaths = new Set(blacklisted.map(foldFieldPath));
+    const globs = compileGlobRules(blacklisted, tableName, operation);
     const conflicts = fields.filter((field) => {
-      const name = field.toLowerCase();
+      const name = foldFieldPath(field);
       if (protectedPaths.has(name))
         return true;
       if (matchAny(name, globs))
@@ -17240,7 +17568,7 @@ class BlacklistValidator {
     const tables = dedupe2(tableNames);
     const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
     const probeNested = blacklistedColumns.some((path) => path.includes("."));
     const presentColumns = new Set(columnList);
@@ -17252,7 +17580,7 @@ class BlacklistValidator {
           continue;
         const value = record[key];
         if (value !== null && typeof value === "object")
-          nestedHeads.add(key);
+          nestedHeads.add(foldFieldPath(key));
       }
     };
     for (const row of rows) {
@@ -17265,35 +17593,54 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const foldHead = (path) => {
-      const dot = path.indexOf(".");
-      return dot < 0 ? path.toLowerCase() : path.slice(0, dot).toLowerCase() + path.slice(dot);
-    };
-    const protectedPaths = new Set(blacklistedColumns.map(foldHead));
-    const globRules = compileGlobRules(blacklistedColumns, foldHead, tables[0] ?? "unknown", "SELECT");
+    const protectedPaths = new Set(blacklistedColumns.map(foldFieldPath));
+    const globRules = compileGlobRules(blacklistedColumns, tables[0] ?? "unknown", "SELECT");
     const presentByFolded = new Map;
-    for (const column of presentColumns)
-      presentByFolded.set(foldHead(column), column);
+    for (const column of presentColumns) {
+      const folded = foldFieldPath(column);
+      const names = presentByFolded.get(folded);
+      if (names === undefined)
+        presentByFolded.set(folded, [column]);
+      else
+        names.push(column);
+    }
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      const present = presentByFolded.get(foldHead(path));
+      const present = presentByFolded.get(foldFieldPath(path));
       if (present !== undefined) {
-        omitted.add(present);
+        for (const name of present)
+          omitted.add(name);
         continue;
       }
       const dot = path.indexOf(".");
       if (dot < 0)
         continue;
-      if (!nestedHeads.has(path.slice(0, dot)))
+      if (!nestedHeads.has(foldFieldPath(path.slice(0, dot))))
         continue;
-      const segments = path.split(".");
-      if (rows.some((row) => hasFieldPath(row, segments)))
+      const segments = path.split(".").map(foldFieldPath);
+      if (rows.some((row) => hasFieldPath(row, segments, PRE_FOLDED)))
         omitted.add(path);
     }
+    const nestedGlobs = globRules.filter((pattern) => pattern.segments.length > 1);
+    const matchedNested = [];
+    if (nestedGlobs.length > 0 && nestedHeads.size > 0) {
+      const pending = new Set(nestedGlobs);
+      const states = compileNestedRules(nestedGlobs);
+      for (const row of rows) {
+        if (pending.size === 0)
+          break;
+        if (row === null || typeof row !== "object")
+          continue;
+        collectNestedMatches(row, states, pending, (pattern) => {
+          matchedNested.push(pattern);
+          omitted.add(pattern.raw);
+        });
+      }
+    }
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot).toLowerCase())) {
+        if (dot > 0 && protectedPaths.has(foldFieldPath(column.slice(0, dot)))) {
           omitted.add(column);
           break;
         }
@@ -17302,7 +17649,7 @@ class BlacklistValidator {
     }
     if (globRules.length > 0) {
       for (const column of presentColumns) {
-        const folded = foldHead(column);
+        const folded = foldFieldPath(column);
         if (matchAny(folded, globRules)) {
           omitted.add(column);
           continue;
@@ -17319,10 +17666,30 @@ class BlacklistValidator {
     }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
-    const filteredRows = omitFieldPaths(rows, omittedColumns);
-    return { filteredRows, omittedColumns };
+    const removalPaths = matchedNested.length === 0 ? omittedColumns : omittedColumns.filter((path) => !matchedNested.some((p) => p.raw === path));
+    const filteredRows = omitFieldPaths(rows, removalPaths, matchedNested.length > 0 ? { ...FOLD_CASE2, patterns: matchedNested } : FOLD_CASE2);
+    return {
+      filteredRows,
+      omittedColumns,
+      reachesOmitted: (path) => {
+        if (omittedByName(removalPaths, path))
+          return true;
+        if (matchedNested.length === 0)
+          return false;
+        const folded = foldFieldPath(path);
+        if (matchAny(folded, matchedNested))
+          return true;
+        let dot = folded.indexOf(".");
+        while (dot > 0) {
+          if (matchAny(folded.slice(0, dot), matchedNested))
+            return true;
+          dot = folded.indexOf(".", dot + 1);
+        }
+        return false;
+      }
+    };
   }
   buildSecurityNotification(_tableName, omittedColumns) {
     if (omittedColumns.length === 0) {
@@ -17333,12 +17700,17 @@ class BlacklistValidator {
     });
   }
 }
+var FOLD_CASE2, PRE_FOLDED;
 var init_blacklist_validator = __esm(() => {
+  init_glob();
   init_blacklist();
   init_message_loader();
   init_field_projection();
   init_path_matcher();
+  init_blacklist_fold();
   init_es_index_target();
+  FOLD_CASE2 = { caseInsensitive: true };
+  PRE_FOLDED = { caseInsensitive: true, alreadyFolded: true };
 });
 
 // src/core/verification/types.ts
@@ -22055,7 +22427,7 @@ Key: ${schema.name}`);
         await esAdapter.disconnect();
       }
     }
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter(config);
     await adapter.connect();
     const mongoMeta = config.connection.system === "mongodb" ? {
       blacklist: config.blacklist ?? { tables: [], columns: {} },
@@ -22544,12 +22916,12 @@ class QueryExecutor {
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
       let filteredRows = rows;
       let securityNotification;
-      let omittedColumns = [];
+      let reachesOmitted = () => false;
       if (this.blacklistValidator) {
         const filterResult = this.blacklistValidator.filterColumnsForTables(referencedTables, rows, columnNames);
         filteredRows = filterResult.filteredRows;
         if (filterResult.omittedColumns.length > 0) {
-          omittedColumns = filterResult.omittedColumns;
+          reachesOmitted = filterResult.reachesOmitted;
           columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
           securityNotification = this.blacklistValidator.buildSecurityNotification(referencedTables[0] ?? "", filterResult.omittedColumns);
         }
@@ -22557,7 +22929,7 @@ class QueryExecutor {
       if (options?.fieldSelection) {
         const fieldSelection = options.fieldSelection.mode === "include" ? {
           mode: "include",
-          paths: options.fieldSelection.paths.filter((path2) => !omittedColumns.some((omitted) => path2 === omitted || path2.startsWith(`${omitted}.`)))
+          paths: options.fieldSelection.paths.filter((path2) => !reachesOmitted(path2))
         } : options.fieldSelection;
         const projection = projectRows(filteredRows, fieldSelection);
         filteredRows = projection.rows;
@@ -22676,7 +23048,7 @@ function maskMongoRows(rows, collection, blacklist) {
   }
   if (patterns.length === 0)
     return rows;
-  const idAffected = patterns.some((p) => p.segments.length === 1 && !p.wildcardTail && globMatches(p.segments[0], "_id"));
+  const idAffected = patterns.some((p) => p.segments.length === 1 && !p.wildcardTail && globMatches(p.segments[0], "_id", { caseInsensitive: true }));
   if (idAffected) {
     console.error(`[blacklist] collection '${collection}' blacklists '_id'; read paths still expose _id to preserve document references.`);
   }
@@ -22702,7 +23074,7 @@ function maskValue(value, path2, patterns) {
   if (value === null || value === undefined)
     return value;
   if (Array.isArray(value)) {
-    return value.map((item) => item && typeof item === "object" && !Array.isArray(item) ? maskRecord(item, path2, patterns) : item);
+    return value.map((item) => maskValue(item, path2, patterns));
   }
   if (typeof value === "object") {
     return maskRecord(value, path2, patterns);
@@ -22710,9 +23082,9 @@ function maskValue(value, path2, patterns) {
   return value;
 }
 function findCaseInsensitive(columns, name) {
-  const target = name.toLowerCase();
+  const target = foldFieldPath(name);
   for (const [k, v] of Object.entries(columns)) {
-    if (k.toLowerCase() === target)
+    if (foldFieldPath(k) === target)
       return v;
   }
   return;
@@ -22721,6 +23093,7 @@ var REDACTED2 = "[REDACTED]";
 var init_field_masker = __esm(() => {
   init_blacklist();
   init_path_matcher();
+  init_blacklist_fold();
   init_glob();
   init_glob();
 });
@@ -24838,9 +25211,9 @@ function applySelectPatternRules(facts, factors) {
   }
 }
 function applyBlacklistRules(facts, blacklist, factors) {
-  const blacklistedTables = new Set((blacklist.tables ?? []).map((table) => table.toLowerCase()));
+  const blacklistedTables = new Set((blacklist.tables ?? []).map(foldFieldPath));
   for (const table of facts.targetTables) {
-    if (blacklistedTables.has(table.toLowerCase())) {
+    if (blacklistedTables.has(foldFieldPath(table))) {
       pushFactor(factors, "table_blacklisted", "block", `Target table ${table} is blacklisted.`);
     }
   }
@@ -24856,7 +25229,7 @@ function applyBlacklistRules(facts, blacklist, factors) {
 function findBlacklistedColumnsForTable(blacklist, table) {
   const columns = blacklist.columns ?? {};
   for (const [tableName2, columnNames] of Object.entries(columns)) {
-    if (tableName2.toLowerCase() === table.toLowerCase()) {
+    if (foldFieldPath(tableName2) === foldFieldPath(table)) {
       return new Set(columnNames);
     }
   }
@@ -24947,6 +25320,7 @@ function buildSuggestedCommands(facts, gap) {
 }
 var READ_LIKE_WORDS, WRITE_OR_DDL_LIKE_WORDS;
 var init_query_risk_analyzer = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
   init_size_category();
   READ_LIKE_WORDS = ["SELECT", "SHOW", "DESCRIBE", "EXPLAIN", "WITH"];
@@ -26503,6 +26877,19 @@ async function qCommand(name, options, command) {
     const family = engineFamily(engine);
     const sqlDialect = SQL_DIALECTS.find((dialect) => dialect === connectionSystem);
     const classification = family === "sql" ? enforcePermission(prepared.rewrittenSql, config.permission, sqlDialect) : undefined;
+    const blacklistManager = new BlacklistManager(config);
+    const blacklistValidator = new BlacklistValidator(blacklistManager);
+    const redisTokens = family === "redis" ? parseRedisCommand(prepared.rewrittenSql) : [];
+    const targets = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
+      ...sqlDialect ? { dialect: sqlDialect } : {}
+    }) : family === "es" ? [prepared.execHints?.index ?? ""] : family === "redis" && redisTokens.length > 0 ? redisCommandTargets(redisTokens[0], redisTokens.slice(1)) : [];
+    const targetName = targets[0] ?? "";
+    targetNameForAudit = family === "redis" ? name : targetName || name;
+    if (family === "es") {
+      blacklistValidator.checkIndexBlacklist("SELECT", targetName);
+    } else if ((classification || family === "redis") && targets.length > 0) {
+      blacklistValidator.checkTablesBlacklist(classification?.type ?? redisTokens[0] ?? "READ", targets);
+    }
     if (options.dryRun) {
       console.log(formatDryRun({
         family,
@@ -26524,19 +26911,7 @@ async function qCommand(name, options, command) {
       await qMongoBranch2(snippet, prepared, options, config);
       return;
     }
-    const blacklistManager = new BlacklistManager(config);
-    const blacklistValidator = new BlacklistValidator(blacklistManager);
-    const targets = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
-      ...sqlDialect ? { dialect: sqlDialect } : {}
-    }) : family === "es" ? [prepared.execHints?.index ?? ""] : [];
-    const targetName = targets[0] ?? "";
-    targetNameForAudit = targetName || name;
-    if (family === "es") {
-      blacklistValidator.checkIndexBlacklist("SELECT", targetName);
-    } else if (classification && targets.length > 0) {
-      blacklistValidator.checkTablesBlacklist(classification.type, targets);
-    }
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter(config);
     await adapter.connect();
     try {
       if (!options.ui && options.format !== "html") {
@@ -26657,6 +27032,8 @@ async function readParamFile(path2) {
   return parsed;
 }
 async function handleQError(error, snippetName, options, config) {
+  const redisBlacklistRejection = config?.connection?.system === "redis" && (error instanceof BlacklistError || error instanceof BlacklistRejection);
+  const reportedError = redisBlacklistRejection ? new BlacklistError(t("errors.redis_target_blacklisted"), "[REDACTED]", error instanceof BlacklistError ? error.operation : error.command) : error;
   let auditId = null;
   let envelopeId;
   if (options.recovery === true) {
@@ -26666,21 +27043,22 @@ async function handleQError(error, snippetName, options, config) {
     auditId = await writeAuditEntry(config, "q", options, {
       success: false,
       target: snippetName,
-      error,
+      error: reportedError,
       ...envelopeId && { recovery_ref: envelopeId }
     });
   }
   if (envelopeId !== undefined) {
     const { emitRecoveryEnvelope: emitRecoveryEnvelope2 } = await Promise.resolve().then(() => (init_recovery(), exports_recovery));
-    emitRecoveryEnvelope2(error, { operation: "q", snippet: snippetName }, { envelopeId, auditRef: auditId ?? undefined });
+    emitRecoveryEnvelope2(reportedError, { operation: "q", snippet: snippetName }, { envelopeId, auditRef: auditId ?? undefined });
   }
   if (error instanceof SavedQueryError) {
     printLocalizedCliError(error.message, error);
     process.exit(1);
   }
-  if (error instanceof BlacklistError) {
-    printLocalizedCliError(error.message, error);
+  if (error instanceof BlacklistError || error instanceof BlacklistRejection) {
+    printLocalizedCliError(reportedError.message, reportedError);
     process.exit(1);
+    return;
   }
   if (error instanceof PermissionError) {
     printLocalizedCliError(t_vars("errors.permission_denied", { required: error.requiredPermission }), error);
@@ -26791,6 +27169,9 @@ function evaluateExpectation(row, expects) {
 var init_q = __esm(() => {
   init_message_loader();
   init_adapters();
+  init_redis_adapter();
+  init_blacklist_enforcer();
+  init_types3();
   init_config();
   init_config_path();
   init_blacklist_manager();
@@ -27245,17 +27626,17 @@ function applyPermission(operation, context, factors) {
   }
 }
 function applyTableBlacklist(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
     pushFactor2(factors, "table_blacklisted", "block", `Target collection ${target} is blacklisted.`);
   }
 }
 function applyColumnBlacklist(target, fields, context, factors) {
   const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
+  const lower = foldFieldPath(target);
   let raw = [];
   for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
+    if (foldFieldPath(t2) === lower) {
       raw = cols;
       break;
     }
@@ -27383,6 +27764,7 @@ var MONGO_OPERATOR_TIER, MONGO_BROAD_FILTER_OPERATORS, analyzeMongoDmlRisk = (in
   };
 };
 var init_dml_plan = __esm(() => {
+  init_blacklist_fold();
   init_path_matcher();
   init_permission_guard();
   MONGO_OPERATOR_TIER = {
@@ -27521,17 +27903,17 @@ function applyPermission2(operation, context, factors) {
   }
 }
 function applyTableBlacklist2(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
     pushFactor3(factors, "table_blacklisted", "block", `Redis key ${target} is blacklisted.`);
   }
 }
 function applyColumnBlacklist2(target, fields, context, factors) {
   const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
+  const lower = foldFieldPath(target);
   let blacklistedFields = [];
   for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
+    if (foldFieldPath(t2) === lower) {
       blacklistedFields = cols;
       break;
     }
@@ -27629,6 +28011,7 @@ var analyzeRedisDmlRisk = (intent, context) => {
   };
 };
 var init_dml_plan2 = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
 });
 
@@ -27678,17 +28061,17 @@ function applyPermission3(operation, context, factors) {
   }
 }
 function applyTableBlacklist3(target, context, factors) {
-  const blacklisted = (context.blacklist.tables ?? []).map((t2) => t2.toLowerCase());
-  if (blacklisted.includes(target.toLowerCase())) {
+  const blacklisted = (context.blacklist.tables ?? []).map(foldFieldPath);
+  if (blacklisted.includes(foldFieldPath(target))) {
     pushFactor4(factors, "table_blacklisted", "block", `Elasticsearch index ${target} is blacklisted.`);
   }
 }
 function applyColumnBlacklist3(target, fields, context, factors) {
   const columns = context.blacklist.columns ?? {};
-  const lower = target.toLowerCase();
+  const lower = foldFieldPath(target);
   let blacklistedFields = [];
   for (const [t2, cols] of Object.entries(columns)) {
-    if (t2.toLowerCase() === lower) {
+    if (foldFieldPath(t2) === lower) {
       blacklistedFields = cols;
       break;
     }
@@ -27771,6 +28154,7 @@ var analyzeElasticsearchDmlRisk = (intent, context) => {
   };
 };
 var init_dml_plan3 = __esm(() => {
+  init_blacklist_fold();
   init_permission_guard();
 });
 
@@ -31896,11 +32280,10 @@ async function checkAction(table, options) {
     const checker = new HealthChecker(adapter);
     const blacklistManager = new BlacklistManager(config);
     const blacklistedColumns = getBlacklistedColumnSet(blacklistManager);
-    const blacklistedTables = getBlacklistedTableSet(blacklistManager);
     const checkTypes = options.checks ? options.checks.split(",") : undefined;
     const sampleSize = parseInt(options.sample, 10) || 1e4;
     if (table) {
-      if (blacklistedTables.has(table.toLowerCase())) {
+      if (blacklistManager.isTableBlacklisted(table)) {
         throw new Error(`Table "${table}" is blacklisted`);
       }
       const schema = await adapter.getTableSchema(table);
@@ -31915,7 +32298,7 @@ async function checkAction(table, options) {
       const reports = [];
       const skipped = [];
       for (const t2 of tables) {
-        if (blacklistedTables.has(t2.name.toLowerCase())) {
+        if (blacklistManager.isTableBlacklisted(t2.name)) {
           skipped.push(`${t2.name} (blacklisted)`);
           continue;
         }
@@ -31991,10 +32374,6 @@ function getBlacklistedColumnSet(manager) {
   }
   return result;
 }
-function getBlacklistedTableSet(manager) {
-  const state = manager.state;
-  return state?.tables || new Set;
-}
 var ALLOWED_FORMATS6, checkCommand;
 var init_check = __esm(() => {
   init_esm();
@@ -35097,7 +35476,10 @@ async function collectInspect(opts) {
   let version = null;
   if (!opts.noConnect && config?.connection && system) {
     const probeTimeout = opts.probeTimeoutMs ?? DEFAULT_PROBE_MS;
-    const adapter = AdapterFactory.createAdapter(config.connection);
+    const adapter = AdapterFactory.createAdapter({
+      ...config,
+      blacklist: config.blacklist ?? { tables: [], columns: {} }
+    });
     let probeError = null;
     const probe = (async () => {
       await adapter.connect();
@@ -35491,8 +35873,12 @@ async function runDiagnostic(input) {
     description: meta.description ?? ""
   };
   let prepared;
+  let redisTokens = [];
   try {
     prepared = prepareExecution(input.snippet, { engine: input.engine, noLimit: false }, {}, {});
+    if (engineFamily(input.engine) === "redis") {
+      redisTokens = parseRedisCommand(prepared.rewrittenSql);
+    }
   } catch (err) {
     const reason = err instanceof SavedQueryError ? err.message : `prepare failed: ${err.message}`;
     return { ...base, rowCount: 0, rows: [], status: "skipped", reason, durationMs: 0 };
@@ -35500,7 +35886,7 @@ async function runDiagnostic(input) {
   const family = engineFamily(input.engine);
   const referencedTables = family === "sql" ? extractTableReferences(prepared.rewrittenSql, {
     ...ENGINE_DIALECT2[input.engine] ? { dialect: ENGINE_DIALECT2[input.engine] } : {}
-  }) : family === "es" && prepared.execHints?.index ? [prepared.execHints.index] : [];
+  }) : family === "es" && prepared.execHints?.index ? [prepared.execHints.index] : family === "redis" && redisTokens.length > 0 ? redisCommandTargets(redisTokens[0], redisTokens.slice(1)) : [];
   if (input.blacklistValidator && referencedTables.length > 0) {
     try {
       input.blacklistValidator.checkTablesBlacklist("SELECT", referencedTables);
@@ -35512,7 +35898,7 @@ async function runDiagnostic(input) {
         rowCount: 0,
         rows: [],
         status: "skipped",
-        reason: err.message,
+        reason: family === "redis" ? "Redis diagnostic skipped by blacklist" : err.message,
         durationMs: 0
       };
     }
@@ -35528,8 +35914,8 @@ async function runDiagnostic(input) {
   try {
     outcome = await Promise.race([exec, timer]);
   } catch (err) {
-    outcome = "error";
-    errorMessage2 = err.message;
+    outcome = err instanceof BlacklistRejection ? "skipped" : "error";
+    errorMessage2 = err instanceof BlacklistRejection ? "Redis diagnostic skipped by blacklist" : err.message;
   }
   const durationMs = Math.round(performance.now() - start);
   if (outcome === "timeout") {
@@ -35542,12 +35928,12 @@ async function runDiagnostic(input) {
       durationMs
     };
   }
-  if (outcome === "error") {
+  if (outcome === "error" || outcome === "skipped") {
     return {
       ...base,
       rowCount: 0,
       rows: [],
-      status: "error",
+      status: outcome,
       reason: errorMessage2 ?? "unknown error",
       durationMs
     };
@@ -35567,6 +35953,9 @@ async function runDiagnostic(input) {
 }
 var ENGINE_DIALECT2;
 var init_run_diagnostic = __esm(() => {
+  init_redis_adapter();
+  init_blacklist_enforcer();
+  init_types3();
   init_saved_queries();
   init_strategies();
   init_sql_tables();
@@ -35630,7 +36019,7 @@ async function collectReport(opts) {
     warnings.push({ severity: "warn", message: "connection config missing after probe" });
     return finalize({ context, sections: [], warnings, generatedAt });
   }
-  const adapter = AdapterFactory.createAdapter(config.connection);
+  const adapter = AdapterFactory.createAdapter(config);
   const blacklistValidator = new BlacklistValidator(new BlacklistManager(config));
   const sectionEvidence = new Map;
   for (const id of sections)
@@ -38519,6 +38908,7 @@ async function collectElasticsearchDoctorResults(config, runtimeOverrides = {})
 var ALLOWED_FORMATS15, SENSITIVE_PATTERNS, runDoctorChecks, defaultDoctorCollectorRuntime, doctorCommand;
 var init_doctor = __esm(() => {
   init_esm();
+  init_blacklist_fold();
   init_colors();
   init_config();
   init_adapters();
@@ -38635,7 +39025,8 @@ var init_doctor = __esm(() => {
         for (const col of columns) {
           const colLower = col.toLowerCase();
           const isSensitive = SENSITIVE_PATTERNS.some((p) => colLower.includes(p));
-          if (isSensitive && !blacklisted.has(col)) {
+          const foldedRules = new Set([...blacklisted].map(foldFieldPath));
+          if (isSensitive && !foldedRules.has(foldFieldPath(col))) {
             unprotected.push(`${table}.${col}`);
           }
         }
@@ -46445,30 +46836,25 @@ function findStrings(node) {
   return found;
 }
 function namesProtectedField(term, protectedFields) {
-  if (protectedFields.has(term))
-    return true;
-  const parts = term.split(".");
-  if (parts.length === 1)
-    return false;
-  for (let start = 0;start < parts.length; start += 1) {
-    for (let end = start + 1;end <= parts.length; end += 1) {
-      if (protectedFields.has(parts.slice(start, end).join(".")))
-        return true;
-    }
-  }
-  return false;
+  return reachesProtected(foldFieldPath(term), contiguousRulesFor(protectedFields));
+}
+function reachesProtected(folded, rules) {
+  return reachesProtectedPath(folded, rules);
 }
 function redactFields(node, fields, trail = []) {
+  return redactWithGlobs(node, contiguousRulesFor(fields), trail.flatMap((entry) => foldFieldPath(entry).split(".")));
+}
+function redactWithGlobs(node, rules, trail) {
   if (Array.isArray(node))
-    return node.map((item) => redactFields(item, fields, trail));
+    return node.map((item) => redactWithGlobs(item, rules, trail));
   if (node === null || typeof node !== "object")
     return node;
   const out = {};
   for (const [key, value] of Object.entries(node)) {
-    const path4 = [...trail, key];
-    if (namesProtectedField(path4.join("."), fields))
+    const path4 = [...trail, ...foldFieldPath(key).split(".")];
+    if (reachesProtectedSegments(path4, rules))
       continue;
-    out[key] = redactFields(value, fields, path4);
+    out[key] = redactWithGlobs(value, rules, path4);
   }
   return out;
 }
@@ -46521,7 +46907,9 @@ function assertNoBlacklistedIndexNamed(args) {
   }
 }
 function collectProtectedFields(blacklistColumns) {
-  return new Set(Object.values(blacklistColumns).flat().map((field) => field.trim()).filter((field) => field.length > 0));
+  const fields = new Set(Object.values(blacklistColumns).flat().map(normalizeBlacklistEntry).filter((field) => field.length > 0));
+  contiguousRulesFor(fields);
+  return fields;
 }
 function queryStringFieldTerms(query) {
   const CONSERVATIVE = /[\s,:()"'[\]{}]+/;
@@ -46563,6 +46951,9 @@ var init_es_shell_guards = __esm(() => {
   init_message_loader();
   init_es_index_target();
   init_elasticsearch();
+  init_blacklist_fold();
+  init_blacklist_manager();
+  init_path_matcher();
   UNSCOPED_METADATA_PREFIXES = ["_cat", "_cluster", "_nodes", "_license"];
   UNSCOPED_METADATA_WITHHELD = {
     _cluster: new Set(["state"]),
@@ -48348,7 +48739,7 @@ async function verifyNewPassword(configPath, target, connectionName, password) {
   process.env[target.varName] = password;
   try {
     const config = await configModule.read(storagePath, connectionName);
-    const adapter = AdapterFactory.createAdapter({
+    const adapter = AdapterFactory.createAdapterWithoutRules({
       ...config.connection,
       password
     });