@carllee1983/dbcli 1.41.0 → 1.43.0

package/dist/core.mjs

@@ -13574,6 +13574,8 @@ function getEngineCapability(system, key) {
 }
 // src/adapters/error-mapper.ts
 function mapError(error, system, options) {
+  if (error instanceof ConnectionError)
+    return error;
   const err = error;
   const errMsg = String(err?.message || String(error));
   const errCode = String(err?.code || "");
@@ -14920,7 +14922,7 @@ class MySQLAdapter {
         JOIN information_schema.KEY_COLUMN_USAGE kcu
           ON rc.CONSTRAINT_NAME = kcu.CONSTRAINT_NAME AND rc.TABLE_NAME = kcu.TABLE_NAME
         WHERE kcu.TABLE_NAME = ? AND rc.CONSTRAINT_SCHEMA = DATABASE()
-        GROUP BY rc.CONSTRAINT_NAME
+        GROUP BY rc.CONSTRAINT_NAME, rc.REFERENCED_TABLE_NAME
       `;
       const fkResult = await this.execute(fkQuery, [tableName]);
       const fkResults = fkResult.rows;
@@ -15152,13 +15154,14 @@ class MongoDBAdapter {
     let docs;
     if (Array.isArray(parsed)) {
       const stages = parsed;
-      const lastStage = stages[stages.length - 1];
-      const alreadyHasLimit = !!lastStage && typeof lastStage === "object" && "$limit" in lastStage;
-      const finalStages = typeof limit === "number" && limit > 0 && !alreadyHasLimit ? [...stages, { $limit: limit }] : stages;
+      const alreadyHasLimit = stages.some((stage) => stage !== null && typeof stage === "object" && ("$limit" in stage));
+      const limitedStages = typeof limit === "number" && limit > 0 && !alreadyHasLimit ? [...stages, { $limit: limit }] : stages;
+      const finalStages = options?.projection ? [...limitedStages, { $project: options.projection }] : limitedStages;
       docs = await collection.aggregate(finalStages).toArray();
     } else {
       const cap2 = typeof limit === "number" && limit > 0 ? limit : 0;
-      docs = await collection.find(parsed).limit(cap2).toArray();
+      const cursor = options?.projection ? collection.find(parsed, { projection: options.projection }) : collection.find(parsed);
+      docs = await cursor.limit(cap2).toArray();
     }
     return { rows: docs, affectedRows: docs.length };
   }
@@ -16743,24 +16746,48 @@ function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
 }
-function stripCommentsAndStrings(sql) {
+function stripCommentsAndStrings(sql, options = {}) {
   let result = "";
   let i = 0;
   while (i < sql.length) {
     const char = sql[i];
-    if (char === "-" && sql[i + 1] === "-") {
+    const mysqlDialect = options.dialect === "mysql" || options.dialect === "mariadb";
+    const dashFollowerCode = sql.charCodeAt(i + 2);
+    const dashStartsComment = char === "-" && sql[i + 1] === "-" && (!mysqlDialect || sql[i + 2] === undefined || dashFollowerCode <= 32 || dashFollowerCode === 127);
+    if (dashStartsComment) {
       while (i < sql.length && sql[i] !== `
 `) {
         i++;
       }
       if (i < sql.length) {
         result += `
+`;
+        i++;
+      }
+      continue;
+    }
+    if (mysqlDialect && char === "#") {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      if (i < sql.length) {
+        result += `
 `;
         i++;
       }
       continue;
     }
     if (char === "/" && sql[i + 1] === "*") {
+      const executableMysqlComment = mysqlDialect && (sql.startsWith("/*!", i) || sql.startsWith("/*M!", i));
+      if (executableMysqlComment) {
+        const prefixLength = sql.startsWith("/*M!", i) ? 4 : 3;
+        const closingIndex = sql.indexOf("*/", i + prefixLength);
+        const bodyEnd = closingIndex === -1 ? sql.length : closingIndex;
+        const executableBody = sql.slice(i + prefixLength, bodyEnd).replace(/^\d+/, " ");
+        result += " " + stripCommentsAndStrings(executableBody, options) + " ";
+        i = closingIndex === -1 ? sql.length : closingIndex + 2;
+        continue;
+      }
       i += 2;
       while (i < sql.length) {
         if (sql[i] === "*" && sql[i + 1] === "/") {
@@ -16772,16 +16799,51 @@ function stripCommentsAndStrings(sql) {
       result += " ";
       continue;
     }
-    if (char === "'" || char === '"') {
-      const quote = char;
+    if (options.dialect === "postgresql" && char === "$") {
+      const delimiter = sql.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0];
+      if (delimiter) {
+        i += delimiter.length;
+        const closingIndex = sql.indexOf(delimiter, i);
+        i = closingIndex === -1 ? sql.length : closingIndex + delimiter.length;
+        result += " ";
+        continue;
+      }
+    }
+    if (mysqlDialect && char === "`") {
       i++;
-      while (i < sql.length && sql[i] !== quote) {
-        if (sql[i] === "\\") {
+      while (i < sql.length) {
+        if (sql[i] === "`") {
+          if (sql[i + 1] === "`") {
+            i += 2;
+            continue;
+          }
           i++;
+          break;
         }
         i++;
       }
-      if (i < sql.length) {
+      result += " ";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      const quote = char;
+      const quoteIndex = i;
+      const postgresEscapeString = options.dialect === "postgresql" && quote === "'" && /[eE]/.test(sql[quoteIndex - 1] ?? "") && !/[A-Za-z0-9_$]/.test(sql[quoteIndex - 2] ?? "");
+      const backslashEscapes = options.dialect === undefined || postgresEscapeString;
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === quote) {
+          if (sql[i + 1] === quote) {
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          i += 2;
+          continue;
+        }
         i++;
       }
       result += " ";
@@ -17144,6 +17206,14 @@ function getOperationTarget(system, command, options, sql) {
 // src/core/limits.ts
 var DEFAULT_QUERY_ONLY_LIMIT = 1000;
 
+// src/agent-core/applied-limit.ts
+function trimAppliedLimit(rows, limit) {
+  const truncated = rows.length > limit;
+  return {
+    rows: truncated ? rows.slice(0, limit) : [...rows],
+    metadata: { truncated, limitApplied: limit }
+  };
+}
 // src/core/audit/logger.ts
 import { appendFile, mkdir as mkdir2, readFile, stat } from "fs/promises";
 import { join } from "path";
@@ -21634,18 +21704,16 @@ var DbcliConfigV2Schema = exports_external.object({
   path: ["default"]
 });
 
-// src/utils/errors.ts
+// src/agent-core/errors.ts
 class ConfigError extends Error {
   constructor(message) {
     super(message);
     this.name = "ConfigError";
-    if (Error.captureStackTrace) {
+    if (Error.captureStackTrace)
       Error.captureStackTrace(this, ConfigError);
-    }
   }
 }
-
-// src/core/env-loader.ts
+// src/agent-core/env-loader.ts
 function parseEnvContent(content) {
   const entries = [];
   for (const line of content.split(`
@@ -21667,19 +21735,13 @@ function parseEnvContent(content) {
 }
 async function loadEnvFile(filePath) {
   const file = Bun.file(filePath);
-  const exists = await file.exists();
-  if (!exists) {
+  if (!await file.exists())
     throw new ConfigError(`\u627E\u4E0D\u5230 env \u6A94\u6848\uFF1A${filePath}`);
-  }
-  const content = await file.text();
-  const entries = parseEnvContent(content);
-  for (const [key, value] of entries) {
-    if (process.env[key] === undefined) {
+  for (const [key, value] of parseEnvContent(await file.text())) {
+    if (process.env[key] === undefined)
       process.env[key] = value;
-    }
   }
 }
-
 // src/core/config-v2.ts
 import { join as join4 } from "path";
 import { mkdir as mkdir5, rename as rename3 } from "fs/promises";
@@ -21749,7 +21811,25 @@ function listConnections(config) {
 // src/core/config.ts
 import { join as join9 } from "path";
 import { mkdir as mkdir6 } from "fs/promises";
+// src/agent-core/env-ref.ts
+function resolveEnvRef(value, fieldName, env = process.env) {
+  if (typeof value === "string")
+    return value;
+  const envKey = value.$env;
+  const resolved = env[envKey];
+  if (resolved === undefined) {
+    throw new ConfigError(`Environment variable not defined: ${envKey} (field: ${fieldName})
+` + `Please set ${envKey} in an env file or your environment.`);
+  }
+  return resolved;
+}
+// src/core/config.ts
 var _globalConnectionName;
+function assertNoConnectionSelectorOnV1(connectionName) {
+  if (connectionName === undefined)
+    return;
+  throw new ConfigError(`\u9023\u7DDA '${connectionName}' \u4E0D\u5B58\u5728\uFF1A\u6B64\u5C08\u6848\u4F7F\u7528\u55AE\u4E00\u9023\u7DDA (v1) \u8A2D\u5B9A\uFF0C\u6C92\u6709\u5177\u540D\u9023\u7DDA\u3002` + ` \u79FB\u9664 --use / DBCLI_CONNECTION\uFF0C\u6216\u6539\u7528 'dbcli init --conn-name <name>' \u5347\u7D1A\u70BA\u591A\u9023\u7DDA (v2) \u8A2D\u5B9A\u3002`);
+}
 function getGlobalConnectionName() {
   return _globalConnectionName;
 }
@@ -21776,18 +21856,10 @@ var DEFAULT_CONFIG = {
 function isEnvReference(value) {
   return typeof value === "object" && value !== null && "$env" in value && typeof value.$env === "string";
 }
-function resolveEnvReferences(config, env, parentKey, strict = false) {
+function resolveEnvReferences(config, env, parentKey) {
   if (isEnvReference(config)) {
     const envKey = config.$env;
-    const value = env[envKey];
-    if (!value) {
-      if (!strict) {
-        return config;
-      }
-      throw new ConfigError(`Environment variable not defined: ${envKey}
-` + `Please set ${envKey} in .env or your environment.
-` + `Hint: check your .env file or run 'export ${envKey}=<value>'`);
-    }
+    const value = resolveEnvRef(config, parentKey ?? "<root>", env);
     if (parentKey === "port") {
       const portNum = parseInt(value, 10);
       if (isNaN(portNum) || portNum < 1 || portNum > 65535) {
@@ -21798,12 +21870,12 @@ function resolveEnvReferences(config, env, parentKey, strict = false) {
     return value;
   }
   if (Array.isArray(config)) {
-    return config.map((item) => resolveEnvReferences(item, env, parentKey, strict));
+    return config.map((item) => resolveEnvReferences(item, env, parentKey));
   }
   if (typeof config === "object" && config !== null) {
     const resolved = {};
     for (const [key, value] of Object.entries(config)) {
-      resolved[key] = resolveEnvReferences(value, env, key, strict);
+      resolved[key] = resolveEnvReferences(value, env, key);
     }
     return resolved;
   }
@@ -21853,7 +21925,7 @@ var configModule = {
                 process.env.DBCLI_PASSWORD = legacyPassword;
               }
             }
-            const resolvedConnection = resolveEnvReferences(resolved.connection, process.env, undefined, false);
+            const resolvedConnection = resolveEnvReferences(resolved.connection, process.env);
             if (!resolvedConnection.password && legacyPassword) {
               resolvedConnection.password = legacyPassword;
             }
@@ -21890,7 +21962,8 @@ var configModule = {
               redis: v2Config.redis
             });
           }
-          const resolvedConfig = resolveEnvReferences(config, process.env, undefined, false);
+          assertNoConnectionSelectorOnV1(effectiveConnectionName);
+          const resolvedConfig = resolveEnvReferences(config, process.env);
           const envPath = join9(storagePath, ".env.local");
           const envFile = Bun.file(envPath);
           if (await envFile.exists()) {
@@ -21906,9 +21979,10 @@ var configModule = {
       const file = Bun.file(path);
       const exists = await file.exists();
       if (exists) {
+        assertNoConnectionSelectorOnV1(effectiveConnectionName);
         const content = await file.text();
         const raw = JSON.parse(content);
-        const resolved = resolveEnvReferences(raw, process.env, undefined, false);
+        const resolved = resolveEnvReferences(raw, process.env);
         return DbcliConfigSchema.parse(resolved);
       }
       return { ...DEFAULT_CONFIG };
@@ -22016,7 +22090,9 @@ var REDACTED_VALUE_FLAGS = new Set([
   "--password",
   "--token",
   "--secret",
-  "--bulk"
+  "--bulk",
+  "--query-file",
+  "-f"
 ]);
 var KEEP_VALUE_FLAGS = new Set([
   "--format",
@@ -22025,17 +22101,33 @@ var KEEP_VALUE_FLAGS = new Set([
   "--output",
   "--limit",
   "--collection",
-  "--index"
+  "--index",
+  "--fields",
+  "--truncate"
 ]);
 var LINT_BOOLEAN_FLAGS = new Set(["--no-schema", "--recovery"]);
+var QUERY_BOOLEAN_FLAGS = new Set(["--ui", "--no-limit", "--no-truncate", "--recovery"]);
 function optionParts(token) {
+  if (token.startsWith("-f") && !token.startsWith("--") && token.length > 2) {
+    return { name: "-f", inlineValue: token.slice(2) };
+  }
   const equals = token.indexOf("=");
   return equals === -1 ? { name: token, inlineValue: undefined } : { name: token.slice(0, equals), inlineValue: token.slice(equals + 1) };
 }
+function isOptionToken(token) {
+  return token.startsWith("--") || token.startsWith("-f");
+}
+function isKnownBooleanFlag(command, name) {
+  if (command === "lint")
+    return LINT_BOOLEAN_FLAGS.has(name);
+  if (command === "query")
+    return QUERY_BOOLEAN_FLAGS.has(name);
+  return false;
+}
 function findSensitiveSubcommand(argv) {
   for (let index = 1;index < argv.length; index++) {
     const token = argv[index];
-    if (token.startsWith("--")) {
+    if (isOptionToken(token)) {
       const { name, inlineValue } = optionParts(token);
       if (inlineValue === undefined && (REDACTED_VALUE_FLAGS.has(name) || KEEP_VALUE_FLAGS.has(name))) {
         index++;
@@ -22058,7 +22150,7 @@ function sensitiveArgvValues(argv) {
       afterEndOfOptions = true;
       continue;
     }
-    if (!afterEndOfOptions && token.startsWith("--")) {
+    if (!afterEndOfOptions && isOptionToken(token)) {
       const { name, inlineValue } = optionParts(token);
       if (REDACTED_VALUE_FLAGS.has(name)) {
         const value = inlineValue ?? argv[index + 1];
@@ -22077,7 +22169,7 @@ function sensitiveArgvValues(argv) {
           index++;
       } else if (inlineValue === undefined && KEEP_VALUE_FLAGS.has(name)) {
         index++;
-      } else if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name)) {
+      } else if (isKnownBooleanFlag(sensitiveCommand?.command, name)) {
         continue;
       } else if (!sensitiveCommand || index < sensitiveCommand.index) {
         continue;
@@ -22108,7 +22200,7 @@ function redactArgv(argv) {
       afterEndOfOptions = true;
       continue;
     }
-    if (!afterEndOfOptions && tok.startsWith("--")) {
+    if (!afterEndOfOptions && isOptionToken(tok)) {
       const { name, inlineValue } = optionParts(tok);
       if (REDACTED_VALUE_FLAGS.has(name)) {
         out.push(`${name} <redacted>`);
@@ -22127,7 +22219,7 @@ function redactArgv(argv) {
         }
         continue;
       }
-      if (sensitiveCommand?.command === "lint" && LINT_BOOLEAN_FLAGS.has(name)) {
+      if (isKnownBooleanFlag(sensitiveCommand?.command, name)) {
         out.push(tok);
         continue;
       }
@@ -22163,9 +22255,9 @@ function redactSql(sql) {
 // src/core/audit/integration-helper.ts
 var _sessionIdService = null;
 var _loggers = new Map;
-async function getAuditLogger(config, configPath) {
+async function getAuditLogger(config, configPath, connectionName) {
   const storagePath = await resolveConfigStoragePath(configPath);
-  const connName = config.effectiveConnectionName || getGlobalConnectionName() || "default";
+  const connName = connectionName || config.effectiveConnectionName || getGlobalConnectionName() || "default";
   const key = `${storagePath}:${connName}`;
   if (!_loggers.has(key)) {
     if (!_sessionIdService) {
@@ -22186,7 +22278,7 @@ async function getAuditLogger(config, configPath) {
 }
 async function writeAuditEntry(config, commandName, options, outcome) {
   try {
-    const logger = await getAuditLogger(config, options.config || ".dbcli");
+    const logger = await getAuditLogger(config, options.config || ".dbcli", typeof options.connectionName === "string" ? options.connectionName : undefined);
     const engine = config.connection?.system || "postgresql";
     const target = outcome.target || getOperationTarget(engine, commandName, options, outcome.sql);
     let tier = getEngineCapability(engine, commandName).tier;
@@ -22218,6 +22310,129 @@ async function writeAuditEntry(config, commandName, options, outcome) {
   }
 }
 
+// src/core/field-projection.ts
+var UNSAFE_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+function projectRows(rows, selection) {
+  if (selection.mode === "include") {
+    return {
+      rows: rows.map((row) => {
+        const projected = {};
+        for (const path of selection.paths) {
+          const result = readPath(row, path.split("."));
+          defineData(projected, path, result.found ? result.value ?? null : null);
+        }
+        return projected;
+      }),
+      columnNames: [...selection.paths]
+    };
+  }
+  const projectedRows = omitFieldPaths(rows, selection.paths);
+  const columnNames = collectColumnNames(projectedRows);
+  return { rows: normalizeRows(projectedRows, columnNames), columnNames };
+}
+function hasFieldPath(row, path) {
+  return readPath(row, path.split(".")).found;
+}
+function omitFieldPaths(rows, paths) {
+  return rows.map((row) => {
+    let projected = cloneRecord(row);
+    for (const path of paths)
+      projected = omitPath(projected, path.split("."));
+    return projected;
+  });
+}
+function readPath(value, segments) {
+  if (segments.length === 0)
+    return { found: true, value };
+  if (Array.isArray(value)) {
+    const results = value.map((item) => readPath(item, segments));
+    return {
+      found: results.some((result) => result.found),
+      value: results.map((result) => result.found ? result.value : undefined)
+    };
+  }
+  if (!isRecord(value))
+    return { found: false };
+  const exactPath = segments.join(".");
+  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
+    return { found: true, value: value[exactPath] };
+  }
+  const [head, ...tail] = segments;
+  if (!Object.prototype.hasOwnProperty.call(value, head))
+    return { found: false };
+  return readPath(value[head], tail);
+}
+function omitPath(value, segments) {
+  if (segments.length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitPath(item, segments));
+  if (!isPlainRecord(value))
+    return value;
+  const exactPath = segments.join(".");
+  const [head, ...tail] = segments;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (key === exactPath)
+      continue;
+    if (key === head) {
+      if (tail.length > 0)
+        defineData(out, key, omitPath(child, tail));
+      continue;
+    }
+    defineData(out, key, child);
+  }
+  return out;
+}
+function cloneRecord(value, omittedKey) {
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (key !== omittedKey)
+      defineData(out, key, child);
+  }
+  return out;
+}
+function collectColumnNames(rows) {
+  const names = [];
+  const seen = new Set;
+  for (const row of rows) {
+    for (const name of Object.keys(row)) {
+      if (!seen.has(name)) {
+        seen.add(name);
+        names.push(name);
+      }
+    }
+  }
+  return names;
+}
+function normalizeRows(rows, columnNames) {
+  return rows.map((row) => {
+    const normalized = {};
+    for (const column of columnNames) {
+      const value = Object.prototype.hasOwnProperty.call(row, column) ? row[column] : null;
+      defineData(normalized, column, value ?? null);
+    }
+    return normalized;
+  });
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isPlainRecord(value) {
+  if (!isRecord(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function defineData(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
+
 // src/core/query-executor.ts
 class QueryExecutor {
   adapter;
@@ -22225,6 +22440,7 @@ class QueryExecutor {
   blacklistValidator;
   config;
   options;
+  pendingDiagnostics = [];
   constructor(adapter, permission, blacklistValidator, config, options = {}) {
     this.adapter = adapter;
     this.permission = permission;
@@ -22232,19 +22448,31 @@ class QueryExecutor {
     this.config = config;
     this.options = options;
   }
+  takeDiagnostics() {
+    const diagnostics = this.pendingDiagnostics;
+    this.pendingDiagnostics = [];
+    return diagnostics;
+  }
   async execute(sql, options) {
     const start = performance.now();
+    this.pendingDiagnostics = [];
     try {
       const classification = enforcePermission(sql, this.permission);
-      if (classification.isDangerous && this.permission === "admin") {
-        console.error(`\u26A0 Warning: executing ${classification.type} operation (admin mode)`);
-      }
+      const dangerousOperationWarning = classification.isDangerous && this.permission === "admin" ? `\u26A0 Warning: executing ${classification.type} operation (admin mode)` : undefined;
       const AUTO_LIMIT_TYPES = new Set(["SELECT"]);
       let executeSql = sql;
-      if (this.permission === "query-only" && AUTO_LIMIT_TYPES.has(classification.type) && !executeSql.match(/LIMIT\s+\d+/i) && options?.autoLimit !== false) {
-        const limitValue = options?.limitValue || DEFAULT_QUERY_ONLY_LIMIT;
-        executeSql = `${executeSql} LIMIT ${limitValue}`;
-        console.error(`Query-only mode: auto-limiting to ${limitValue} rows`);
+      let appliedLimit;
+      let autoLimitWarning;
+      if (AUTO_LIMIT_TYPES.has(classification.type) && !hasUserAuthoredLimit(executeSql) && options?.autoLimit !== false) {
+        const requestedLimit = options?.limitValue ?? (this.permission === "query-only" ? DEFAULT_QUERY_ONLY_LIMIT : undefined);
+        if (requestedLimit !== undefined) {
+          const fetchLimit = requestedLimit + (options?.detectTruncation === true ? 1 : 0);
+          appliedLimit = options?.detectTruncation === true ? requestedLimit : undefined;
+          executeSql = `${executeSql.replace(/;\s*$/, "")} LIMIT ${fetchLimit}`;
+          if (options?.limitValue === undefined && this.permission === "query-only") {
+            autoLimitWarning = `Query-only mode: auto-limiting to ${requestedLimit} rows`;
+          }
+        }
       }
       if (this.blacklistValidator) {
         const tableName = extractTableName(sql);
@@ -22254,26 +22482,39 @@ class QueryExecutor {
       }
       const resultData = await this.adapter.execute(executeSql);
       const executionTimeMs = Math.round(performance.now() - start);
-      const rows = resultData.rows;
+      const limitedResult = appliedLimit === undefined ? undefined : trimAppliedLimit(resultData.rows, appliedLimit);
+      const rows = limitedResult?.rows ?? resultData.rows;
       const affectedRows = resultData.affectedRows;
+      const visibleAffectedRows = limitedResult ? rows.length : affectedRows;
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
-      const columnTypes = columnNames.map((col) => {
-        const value = rows[0]?.[col];
-        return inferColumnType(value);
-      });
       let filteredRows = rows;
       let securityNotification;
+      let omittedColumns = [];
       if (this.blacklistValidator) {
         const tableName = extractTableName(sql);
         if (tableName) {
           const filterResult = this.blacklistValidator.filterColumns(tableName, rows, columnNames);
           filteredRows = filterResult.filteredRows;
           if (filterResult.omittedColumns.length > 0) {
+            omittedColumns = filterResult.omittedColumns;
             columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
             securityNotification = this.blacklistValidator.buildSecurityNotification(tableName, filterResult.omittedColumns);
           }
         }
       }
+      if (options?.fieldSelection) {
+        const fieldSelection = options.fieldSelection.mode === "include" ? {
+          mode: "include",
+          paths: options.fieldSelection.paths.filter((path) => !omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`)))
+        } : options.fieldSelection;
+        const projection = projectRows(filteredRows, fieldSelection);
+        filteredRows = projection.rows;
+        columnNames = projection.columnNames;
+      }
+      const columnTypes = columnNames.map((column) => {
+        const value = filteredRows.find((row) => row[column] !== undefined)?.[column];
+        return inferColumnType(value);
+      });
       const result = {
         rows: filteredRows,
         rowCount: filteredRows.length,
@@ -22282,20 +22523,30 @@ class QueryExecutor {
         executionTimeMs,
         metadata: {
           statement: classification.type,
-          affectedRows,
+          affectedRows: visibleAffectedRows,
           ...securityNotification ? { securityNotification } : {}
-        }
+        },
+        ...limitedResult ? { appliedLimit: limitedResult.metadata } : {}
       };
       if (this.config) {
         await writeAuditEntry(this.config, "query", this.options, {
           success: true,
           sql,
           metadata: {
-            rows_affected: affectedRows,
+            rows_affected: visibleAffectedRows,
             execution_ms: executionTimeMs
           }
         });
       }
+      if (this.options.recovery !== true) {
+        const diagnostics = [dangerousOperationWarning, autoLimitWarning].filter((diagnostic) => diagnostic !== undefined);
+        if (this.options.deferDiagnostics === true) {
+          this.pendingDiagnostics = diagnostics;
+        } else {
+          for (const diagnostic of diagnostics)
+            console.error(diagnostic);
+        }
+      }
       return result;
     } catch (error) {
       if (this.config) {
@@ -22329,6 +22580,10 @@ class QueryExecutor {
     }
   }
 }
+function hasUserAuthoredLimit(sql) {
+  const executableSql = stripCommentsAndStrings(sql).replace(/`(?:``|[^`])*`/g, " ");
+  return /\bLIMIT\s+(?:\(\s*)?(?:\d+|ALL\b|\?|\$\d+|:[A-Za-z_][A-Za-z0-9_]*)/i.test(executableSql);
+}
 function inferColumnType(value) {
   if (value === null || value === undefined) {
     return "null";
@@ -22964,19 +23219,11 @@ class BlacklistValidator {
     if (blacklistedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }
-    const omittedColumns = columnList.filter((col) => blacklistedColumns.includes(col));
+    const omittedColumns = blacklistedColumns.filter((path3) => columnList.includes(path3) || rows.some((row) => hasFieldPath(row, path3)));
     if (omittedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }
-    const filteredRows = rows.map((row) => {
-      const newRow = {};
-      for (const [key, value] of Object.entries(row)) {
-        if (!omittedColumns.includes(key)) {
-          newRow[key] = value;
-        }
-      }
-      return newRow;
-    });
+    const filteredRows = omitFieldPaths(rows, omittedColumns);
     return { filteredRows, omittedColumns };
   }
   buildSecurityNotification(_tableName, omittedColumns) {