@carllee1983/dbcli 1.47.1 → 1.49.0

package/dist/core.mjs

@@ -15819,22 +15819,27 @@ function truncateResult(command, reply, opts) {
   return { value: reply };
 }
 
-// src/adapters/redis/blacklist-enforcer.ts
+// src/utils/glob.ts
 function globToRegex(glob) {
   let out = "^";
   for (let i = 0;i < glob.length; i++) {
     const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      out += glob[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      continue;
+    }
     if (c === "*")
       out += ".*";
     else if (c === "?")
       out += ".";
     else if (c === "[") {
-      const end = glob.indexOf("]", i);
-      if (end === -1)
-        out += "\\[";
-      else {
-        out += glob.slice(i, end + 1);
+      const end = findClassEnd(glob, i);
+      const body = end === -1 ? "" : glob.slice(i, end + 1);
+      if (body !== "" && isValidCharacterClass(body)) {
+        out += body;
         i = end;
+      } else {
+        out += "\\[";
       }
     } else if (".^$+(){}|\\".includes(c)) {
       out += "\\" + c;
@@ -15845,6 +15850,27 @@ function globToRegex(glob) {
   out += "$";
   return new RegExp(out);
 }
+function findClassEnd(glob, open) {
+  for (let i = open + 1;i < glob.length; i++) {
+    if (glob[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (glob[i] === "]")
+      return i;
+  }
+  return -1;
+}
+function isValidCharacterClass(body) {
+  try {
+    new RegExp(body);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/adapters/redis/blacklist-enforcer.ts
 function patternsOverlap(a, b) {
   const ra = globToRegex(a);
   const rb = globToRegex(b);
@@ -16801,6 +16827,32 @@ class AdapterFactory {
     return AdapterFactory.createQueryableAdapter(options);
   }
 }
+// src/utils/sql-lexical.ts
+var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
+var IDENTIFIER_START = /[A-Za-z_]|[\u0080-\uFFFF]/;
+var DOLLAR_QUOTE_DELIMITER = /^\$(?:(?:[A-Za-z_]|[\u0080-\uFFFF])(?:[A-Za-z0-9_]|[\u0080-\uFFFF])*)?\$/;
+function dollarQuoteDelimiterAt(sql, index) {
+  if (sql[index] !== "$")
+    return;
+  if (continuesIdentifier(sql, index))
+    return;
+  return sql.slice(index).match(DOLLAR_QUOTE_DELIMITER)?.[0];
+}
+function continuesIdentifier(sql, index) {
+  let start = index;
+  while (start > 0 && IDENTIFIER_CONTINUATION.test(sql[start - 1] ?? ""))
+    start--;
+  if (start === index)
+    return false;
+  const run = sql.slice(start, index);
+  const first = run[0];
+  if (IDENTIFIER_START.test(first))
+    return true;
+  if (first === "$")
+    return false;
+  return run.replace(/^[0-9]+(?:[eE][0-9]+)?/, "").length > 0;
+}
+
 // src/core/permission-guard.ts
 class PermissionError extends Error {
   classification;
@@ -16817,7 +16869,6 @@ function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
 }
-var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
 function stripCommentsAndStrings(sql, options = {}) {
   let result = "";
   let i = 0;
@@ -16880,8 +16931,7 @@ function stripCommentsAndStrings(sql, options = {}) {
       continue;
     }
     if (options.dialect === "postgresql" && char === "$") {
-      const opensToken = !IDENTIFIER_CONTINUATION.test(sql[i - 1] ?? "");
-      const delimiter = opensToken ? sql.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0] : undefined;
+      const delimiter = dollarQuoteDelimiterAt(sql, i);
       if (delimiter) {
         i += delimiter.length;
         const closingIndex = sql.indexOf(delimiter, i);
@@ -17311,28 +17361,345 @@ async function getAllTablesFromAdapter(adapter) {
   }
 }
 
-// src/utils/engine-hints.ts
-var TABLE_NAME_RE = /\b(?:FROM|INTO|UPDATE)\s+["'`]?([a-zA-Z_][a-zA-Z0-9_]*)["'`]?/i;
-function extractTableName(sql) {
-  const match = sql.match(TABLE_NAME_RE);
-  return match ? match[1] ?? null : null;
-}
-function getOperationTarget(system, command, options, sql) {
-  if (system === "mongodb") {
-    return options.collection || "<unknown-collection>";
+// src/utils/sql-tables.ts
+var TABLE_INTRODUCERS = new Set([
+  "FROM",
+  "JOIN",
+  "INTO",
+  "UPDATE",
+  "TABLE",
+  "TRUNCATE",
+  "COPY",
+  "USING",
+  "STRAIGHT_JOIN"
+]);
+var PRE_TABLE_NOISE = new Set(["ONLY", "LATERAL", "TABLE"]);
+var SUBQUERY_OPENERS = new Set(["SELECT", "WITH", "VALUES", "TABLE"]);
+var AS_KEYWORD = new Set(["AS"]);
+var POST_TABLE_KEYWORDS = new Set([
+  "AS",
+  "ON",
+  "USING",
+  "WHERE",
+  "GROUP",
+  "ORDER",
+  "HAVING",
+  "LIMIT",
+  "OFFSET",
+  "FETCH",
+  "WINDOW",
+  "UNION",
+  "INTERSECT",
+  "EXCEPT",
+  "JOIN",
+  "INNER",
+  "LEFT",
+  "RIGHT",
+  "FULL",
+  "OUTER",
+  "CROSS",
+  "NATURAL",
+  "STRAIGHT_JOIN",
+  "SET",
+  "VALUES",
+  "SELECT",
+  "RETURNING",
+  "FOR",
+  "INTO",
+  "PARTITION",
+  "WITH",
+  "TABLESAMPLE",
+  "FORCE",
+  "IGNORE",
+  "USE"
+]);
+var RESERVED_KEYWORDS = new Set([
+  "ALL",
+  "AND",
+  "AS",
+  "ASC",
+  "CASE",
+  "CROSS",
+  "DESC",
+  "DISTINCT",
+  "ELSE",
+  "FALSE",
+  "FOR",
+  "FROM",
+  "GROUP",
+  "HAVING",
+  "IN",
+  "INNER",
+  "INTO",
+  "IS",
+  "JOIN",
+  "LEFT",
+  "LIKE",
+  "LIMIT",
+  "NOT",
+  "NULL",
+  "ON",
+  "OR",
+  "ORDER",
+  "OUTER",
+  "RIGHT",
+  "SELECT",
+  "THEN",
+  "TRUE",
+  "UNION",
+  "USING",
+  "VALUES",
+  "WHEN",
+  "WHERE",
+  "WITH"
+]);
+var IDENTIFIER_START2 = /[A-Za-z_\u0080-\uFFFF]/;
+var IDENTIFIER_PART = /[A-Za-z0-9_$\u0080-\uFFFF]/;
+function tokenize(sql, dialect, backslashEscapes) {
+  const tokens = [];
+  const mysqlDialect = dialect === "mysql" || dialect === "mariadb";
+  let i = 0;
+  while (i < sql.length) {
+    const char = sql[i];
+    const dashFollowerCode = sql.charCodeAt(i + 2);
+    if (char === "-" && sql[i + 1] === "-" && (!mysqlDialect || sql[i + 2] === undefined || dashFollowerCode <= 32 || dashFollowerCode === 127)) {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (mysqlDialect && char === "#") {
+      while (i < sql.length && sql[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (char === "/" && sql[i + 1] === "*") {
+      if (mysqlDialect && (sql.startsWith("/*!", i) || sql.startsWith("/*M!", i))) {
+        const prefixLength = sql.startsWith("/*M!", i) ? 4 : 3;
+        const closingIndex = sql.indexOf("*/", i + prefixLength);
+        const bodyEnd = closingIndex === -1 ? sql.length : closingIndex;
+        const body = sql.slice(i + prefixLength, bodyEnd).replace(/^\d+/, " ");
+        tokens.push(...tokenize(body, dialect, backslashEscapes));
+        i = closingIndex === -1 ? sql.length : closingIndex + 2;
+        continue;
+      }
+      const nests = dialect === "postgresql";
+      let depth = 1;
+      i += 2;
+      while (i < sql.length && depth > 0) {
+        if (nests && sql[i] === "/" && sql[i + 1] === "*") {
+          depth++;
+          i += 2;
+          continue;
+        }
+        if (sql[i] === "*" && sql[i + 1] === "/") {
+          depth--;
+          i += 2;
+          continue;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (dialect === "postgresql" && char === "$") {
+      const delimiter = dollarQuoteDelimiterAt(sql, i);
+      if (delimiter) {
+        i += delimiter.length;
+        const closingIndex = sql.indexOf(delimiter, i);
+        i = closingIndex === -1 ? sql.length : closingIndex + delimiter.length;
+        continue;
+      }
+    }
+    if (char === "'") {
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === "'") {
+          if (sql[i + 1] === "'") {
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (char === '"' || char === "`") {
+      const quote = char;
+      i++;
+      let value = "";
+      while (i < sql.length) {
+        if (sql[i] === quote) {
+          if (sql[i + 1] === quote) {
+            value += quote;
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        if (backslashEscapes && sql[i] === "\\") {
+          value += sql[i + 1] ?? "";
+          i += 2;
+          continue;
+        }
+        value += sql[i];
+        i++;
+      }
+      tokens.push({ value, kind: "identifier", quoted: true });
+      continue;
+    }
+    if (IDENTIFIER_START2.test(char)) {
+      let value = "";
+      while (i < sql.length && IDENTIFIER_PART.test(sql[i])) {
+        value += sql[i];
+        i++;
+      }
+      tokens.push({ value, kind: "identifier", quoted: false });
+      continue;
+    }
+    if (char === "." || char === "," || char === "(" || char === ")" || char === ";") {
+      tokens.push({ value: char, kind: "punctuation", quoted: false });
+      i++;
+      continue;
+    }
+    i++;
   }
-  if (system === "elasticsearch") {
-    return options.index || options.collection || "<unknown-index>";
+  return tokens;
+}
+function isKeyword(token, keywords) {
+  if (!token || token.kind !== "identifier" || token.quoted)
+    return false;
+  return keywords.has(token.value.toUpperCase());
+}
+function isPunctuation(token, value) {
+  return token?.kind === "punctuation" && token.value === value;
+}
+function readQualifiedName(tokens, index) {
+  const first = tokens[index];
+  if (!first || first.kind !== "identifier")
+    return null;
+  const parts = [first.value];
+  let cursor = index + 1;
+  while (isPunctuation(tokens[cursor], ".") && tokens[cursor + 1]?.kind === "identifier") {
+    parts.push(tokens[cursor + 1].value);
+    cursor += 2;
   }
-  if (system === "redis") {
-    return options.table || options.key || "<unknown-key>";
+  return { parts, next: cursor };
+}
+var ANY_ESCAPE_SEQUENCE = /([^0-9a-fA-F+'"\s])(?:\+([0-9a-fA-F]{6})|([0-9a-fA-F]{4}))/g;
+function decodedVariants(value) {
+  const decoded = value.replace(ANY_ESCAPE_SEQUENCE, (whole, _escape, long, short) => fromCodePointOrRaw(long ?? short, whole));
+  return decoded === value ? [] : [decoded];
+}
+function fromCodePointOrRaw(hex, whole) {
+  const codePoint = parseInt(hex, 16);
+  return codePoint <= 1114111 ? String.fromCodePoint(codePoint) : whole;
+}
+function extractTableReferences(sql, options = {}) {
+  const seen = new Set;
+  const references = [];
+  const record = (name) => {
+    const key = name.toLowerCase();
+    if (name.length === 0 || seen.has(key))
+      return;
+    seen.add(key);
+    references.push(name);
+  };
+  const dialects = options.dialect ? [options.dialect] : ["postgresql", "mysql", undefined];
+  for (const dialect of dialects) {
+    for (const backslashEscapes of [false, true]) {
+      collectReferences(tokenize(sql, dialect, backslashEscapes), record);
+    }
+  }
+  return references;
+}
+function collectReferences(tokens, record) {
+  const recordName = (parts) => {
+    const bare = parts[parts.length - 1];
+    record(bare);
+    for (const variant of decodedVariants(bare))
+      record(variant);
+    if (parts.length > 1)
+      record(parts.join("."));
+  };
+  let i = 0;
+  while (i < tokens.length) {
+    if (!isKeyword(tokens[i], TABLE_INTRODUCERS)) {
+      i++;
+      continue;
+    }
+    const introducer = tokens[i].value.toUpperCase();
+    const parenMeansFunction = introducer === "FROM" || introducer === "JOIN";
+    let cursor = i + 1;
+    while (isKeyword(tokens[cursor], PRE_TABLE_NOISE))
+      cursor++;
+    while (parenMeansFunction && isPunctuation(tokens[cursor], "(") && !isKeyword(tokens[cursor + 1], SUBQUERY_OPENERS) && tokens[cursor + 1]?.kind === "identifier") {
+      cursor++;
+    }
+    let expectTable = true;
+    while (expectTable) {
+      expectTable = false;
+      const name = readQualifiedName(tokens, cursor);
+      if (!name)
+        break;
+      const isFunctionCall = parenMeansFunction && isPunctuation(tokens[name.next], "(");
+      if (!isFunctionCall)
+        recordName(name.parts);
+      cursor = name.next;
+      if (isFunctionCall)
+        break;
+      if (isKeyword(tokens[cursor], AS_KEYWORD))
+        cursor++;
+      if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS)) {
+        cursor++;
+      }
+      while (isPunctuation(tokens[cursor], "(")) {
+        let depth = 0;
+        do {
+          if (isPunctuation(tokens[cursor], "("))
+            depth++;
+          else if (isPunctuation(tokens[cursor], ")"))
+            depth--;
+          cursor++;
+        } while (depth > 0 && cursor < tokens.length);
+        if (tokens[cursor]?.kind === "identifier" && !isKeyword(tokens[cursor], POST_TABLE_KEYWORDS))
+          cursor++;
+      }
+      if (isPunctuation(tokens[cursor], ",")) {
+        cursor++;
+        expectTable = true;
+      }
+    }
+    i = Math.max(cursor, i + 1);
   }
-  if (sql) {
-    const table = extractTableName(sql);
-    if (table)
-      return table;
+  let index = 0;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    if (!token || token.kind !== "identifier") {
+      index++;
+      continue;
+    }
+    const name = readQualifiedName(tokens, index);
+    for (let part = 0;part < name.parts.length; part++) {
+      const value = name.parts[part];
+      const isQuoted = tokens[index + part * 2]?.quoted === true;
+      if (isQuoted || !RESERVED_KEYWORDS.has(value.toUpperCase())) {
+        record(value);
+        for (const variant of decodedVariants(value))
+          record(variant);
+      }
+    }
+    if (name.parts.length > 1)
+      record(name.parts.join("."));
+    index = name.next;
   }
-  return options.table || "<unknown-target>";
 }
 
 // src/core/limits.ts
@@ -22745,6 +23112,30 @@ function redactSql(sql) {
   return redactSensitive(redacted);
 }
 
+// src/utils/engine-hints.ts
+var TABLE_NAME_RE = /\b(?:FROM|INTO|UPDATE)\s+["'`]?([a-zA-Z_][a-zA-Z0-9_]*)["'`]?/i;
+function extractTableName(sql) {
+  const match = sql.match(TABLE_NAME_RE);
+  return match ? match[1] ?? null : null;
+}
+function getOperationTarget(system, command, options, sql) {
+  if (system === "mongodb") {
+    return options.collection || "<unknown-collection>";
+  }
+  if (system === "elasticsearch") {
+    return options.index || options.collection || "<unknown-index>";
+  }
+  if (system === "redis") {
+    return options.table || options.key || "<unknown-key>";
+  }
+  if (sql) {
+    const table = extractTableName(sql);
+    if (table)
+      return table;
+  }
+  return options.table || "<unknown-target>";
+}
+
 // src/core/audit/integration-helper.ts
 var _sessionIdService = null;
 var _loggers = new Map;
@@ -22828,17 +23219,37 @@ function projectRows(rows, selection) {
   const columnNames = collectColumnNames(projectedRows);
   return { rows: normalizeRows(projectedRows, columnNames), columnNames };
 }
-function hasFieldPath(row, path) {
-  return readPath(row, path.split(".")).found;
+function hasFieldPath(row, segments) {
+  return readPath(row, segments).found;
 }
 function omitFieldPaths(rows, paths) {
-  return rows.map((row) => {
-    let projected = cloneRecord(row);
-    for (const path of paths)
-      projected = omitPath(projected, path.split("."));
+  const topLevel = new Set(paths);
+  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: path.slice(0, path.indexOf(".")), segments: path.split(".") }));
+  const maskRecord = (row) => {
+    let projected = cloneRecord(row, topLevel);
+    for (const { head, segments } of dotted) {
+      const value = row[head];
+      if (value !== null && typeof value === "object")
+        projected = omitPath(projected, segments);
+    }
     return projected;
+  };
+  return rows.map((row) => {
+    if (row === null || typeof row !== "object")
+      return {};
+    if (Array.isArray(row))
+      return maskArrayRow(row, maskRecord);
+    return maskRecord(row);
   });
 }
+function maskArrayRow(row, maskRecord) {
+  const out = {};
+  row.forEach((item, index) => {
+    const masked = Array.isArray(item) ? maskArrayRow(item, maskRecord) : item !== null && typeof item === "object" ? maskRecord(item) : item;
+    defineData(out, String(index), masked);
+  });
+  return out;
+}
 function readPath(value, segments) {
   if (segments.length === 0)
     return { found: true, value };
@@ -22882,10 +23293,10 @@ function omitPath(value, segments) {
   }
   return out;
 }
-function cloneRecord(value, omittedKey) {
+function cloneRecord(value, omittedKeys) {
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (key !== omittedKey)
+    if (!omittedKeys.has(key))
       defineData(out, key, child);
   }
   return out;
@@ -22978,11 +23389,9 @@ class QueryExecutor {
           }
         }
       }
-      if (this.blacklistValidator) {
-        const tableName = extractTableName(sql);
-        if (tableName) {
-          this.blacklistValidator.checkTableBlacklist(classification.type, tableName, []);
-        }
+      const referencedTables = this.blacklistValidator ? extractTableReferences(sql, { dialect: this.resolveDialect() }) : [];
+      if (this.blacklistValidator && referencedTables.length > 0) {
+        this.blacklistValidator.checkTablesBlacklist(classification.type, referencedTables);
       }
       const resultData = await this.adapter.execute(executeSql);
       const executionTimeMs = Math.round(performance.now() - start);
@@ -22995,15 +23404,12 @@ class QueryExecutor {
       let securityNotification;
       let omittedColumns = [];
       if (this.blacklistValidator) {
-        const tableName = extractTableName(sql);
-        if (tableName) {
-          const filterResult = this.blacklistValidator.filterColumns(tableName, rows, columnNames);
-          filteredRows = filterResult.filteredRows;
-          if (filterResult.omittedColumns.length > 0) {
-            omittedColumns = filterResult.omittedColumns;
-            columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
-            securityNotification = this.blacklistValidator.buildSecurityNotification(tableName, filterResult.omittedColumns);
-          }
+        const filterResult = this.blacklistValidator.filterColumnsForTables(referencedTables, rows, columnNames);
+        filteredRows = filterResult.filteredRows;
+        if (filterResult.omittedColumns.length > 0) {
+          omittedColumns = filterResult.omittedColumns;
+          columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
+          securityNotification = this.blacklistValidator.buildSecurityNotification(referencedTables[0] ?? "", filterResult.omittedColumns);
         }
       }
       if (options?.fieldSelection) {
@@ -23665,6 +24071,14 @@ class BlacklistManager {
     }
     return Array.from(columnSet);
   }
+  getAllBlacklistedColumns() {
+    const all = new Set;
+    for (const columnSet of this.state.columns.values()) {
+      for (const column of columnSet)
+        all.add(column);
+    }
+    return Array.from(all);
+  }
   canOverrideBlacklist() {
     return this.overrideEnabled;
   }
@@ -23672,28 +24086,132 @@ class BlacklistManager {
     return this.state;
   }
 }
+// src/utils/es-index-target.ts
+var MAX_DECODE_PASSES = 4;
+function unwrap(target) {
+  let current = target;
+  for (let pass = 0;pass < MAX_DECODE_PASSES; pass++) {
+    let next = current;
+    try {
+      next = decodeURIComponent(next);
+    } catch {}
+    if (next.startsWith("<") && next.endsWith(">")) {
+      next = next.slice(1, -1).replace(/\{[^}]*\}/g, "*");
+    }
+    if (next === current)
+      return current;
+    current = next;
+  }
+  return current;
+}
+function expandIndexTargets(target) {
+  const concrete = [];
+  const wildcards = [];
+  const add = (candidate) => {
+    if (candidate.length === 0)
+      return;
+    if (/[*?]/.test(candidate) || candidate.toLowerCase() === "_all")
+      wildcards.push(candidate);
+    else
+      concrete.push(candidate);
+  };
+  for (const rawPart of unwrap(target).split(",")) {
+    const part = unwrap(rawPart.trim()).trim().replace(/^[-+]/, "");
+    if (part.length === 0)
+      continue;
+    add(part);
+    if (part.includes(":"))
+      for (const section of part.split(":"))
+        add(section);
+  }
+  return { concrete, wildcards };
+}
+function matchesIndexGlob(pattern, name) {
+  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
+  try {
+    return globToRegex(normalized).test(name.toLowerCase());
+  } catch {
+    return true;
+  }
+}
+
 // src/core/blacklist-validator.ts
+function flattenArrayRow(row) {
+  const records = [];
+  for (const item of row) {
+    if (Array.isArray(item))
+      records.push(...flattenArrayRow(item));
+    else if (item !== null && typeof item === "object")
+      records.push(item);
+  }
+  return records;
+}
+function dedupe2(values) {
+  const seen = new Set;
+  const result = [];
+  for (const value of values) {
+    const key = value.toLowerCase();
+    if (value.length === 0 || seen.has(key))
+      continue;
+    seen.add(key);
+    result.push(value);
+  }
+  return result;
+}
+
 class BlacklistValidator {
   manager;
   constructor(manager) {
     this.manager = manager;
   }
-  checkTableBlacklist(operation, tableName, _tableList = []) {
+  checkTableBlacklist(operation, tableName, tableList = []) {
+    this.checkTablesBlacklist(operation, [tableName, ...tableList]);
+  }
+  checkTablesBlacklist(operation, tableNames) {
+    const tables = dedupe2(tableNames);
+    if (tables.length === 0) {
+      return;
+    }
     if (this.manager.canOverrideBlacklist()) {
-      const message = t_vars("warnings.blacklist_override_used", {
+      const message2 = t_vars("warnings.blacklist_override_used", {
         operation,
-        table: tableName
+        table: tables.join(", ")
       });
-      console.error(message);
+      console.error(message2);
       return;
     }
-    if (this.manager.isTableBlacklisted(tableName)) {
-      const message = t_vars("errors.table_blacklisted", {
-        table: tableName,
-        operation
-      });
-      throw new BlacklistError(message, tableName, operation);
+    const blocked = tables.filter((table) => this.manager.isTableBlacklisted(table));
+    if (blocked.length === 0) {
+      return;
     }
+    const message = t_vars("errors.table_blacklisted", {
+      table: blocked.join(", "),
+      operation
+    });
+    throw new BlacklistError(message, blocked[0], operation);
+  }
+  checkIndexBlacklist(operation, target) {
+    const { concrete, wildcards } = expandIndexTargets(target);
+    this.checkTablesBlacklist(operation, concrete);
+    if (wildcards.length === 0 || this.manager.canOverrideBlacklist())
+      return;
+    const blacklisted = Array.from(this.manager.getState().tables);
+    if (blacklisted.length === 0)
+      return;
+    const reachable = wildcards.filter((pattern) => blacklisted.some((entry) => matchesIndexGlob(pattern, entry)));
+    if (reachable.length === 0)
+      return;
+    const message = t_vars("errors.table_blacklisted", {
+      table: reachable.join(", "),
+      operation
+    });
+    throw new BlacklistError(message, reachable[0], operation);
+  }
+  filterColumnsForIndexExpression(target, rows, columnList) {
+    const { concrete, wildcards } = expandIndexTargets(target);
+    const ruleKeys = Array.from(this.manager.getState().columns.keys());
+    const reachable = ruleKeys.filter((key) => wildcards.some((pattern) => matchesIndexGlob(pattern, key)));
+    return this.filterColumnsForTables([...concrete, ...reachable], rows, columnList);
   }
   checkColumnBlacklistOnWrite(tableName, fields, operation = "WRITE") {
     const blacklisted = this.manager.getBlacklistedColumns(tableName);
@@ -23720,11 +24238,64 @@ class BlacklistValidator {
     throw new BlacklistError(message, tableName, operation);
   }
   filterColumns(tableName, rows, columnList) {
-    const blacklistedColumns = this.manager.getBlacklistedColumns(tableName);
+    return this.filterColumnsForTables([tableName], rows, columnList);
+  }
+  filterColumnsForTables(tableNames, rows, columnList) {
+    const tables = dedupe2(tableNames);
+    const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }
-    const omittedColumns = blacklistedColumns.filter((path3) => columnList.includes(path3) || rows.some((row) => hasFieldPath(row, path3)));
+    const probeNested = blacklistedColumns.some((path3) => path3.includes("."));
+    const presentColumns = new Set(columnList);
+    const nestedHeads = new Set;
+    const collect = (record) => {
+      for (const key of Object.getOwnPropertyNames(record)) {
+        presentColumns.add(key);
+        if (!probeNested)
+          continue;
+        const value = record[key];
+        if (value !== null && typeof value === "object")
+          nestedHeads.add(key);
+      }
+    };
+    for (const row of rows) {
+      if (row === null || typeof row !== "object")
+        continue;
+      if (Array.isArray(row)) {
+        for (const item of flattenArrayRow(row))
+          collect(item);
+        continue;
+      }
+      collect(row);
+    }
+    const protectedPaths = new Set(blacklistedColumns);
+    const omitted = new Set;
+    for (const path3 of blacklistedColumns) {
+      if (presentColumns.has(path3)) {
+        omitted.add(path3);
+        continue;
+      }
+      const dot = path3.indexOf(".");
+      if (dot < 0)
+        continue;
+      if (!nestedHeads.has(path3.slice(0, dot)))
+        continue;
+      const segments = path3.split(".");
+      if (rows.some((row) => hasFieldPath(row, segments)))
+        omitted.add(path3);
+    }
+    for (const column of presentColumns) {
+      let dot = column.indexOf(".");
+      while (dot >= 0) {
+        if (dot > 0 && protectedPaths.has(column.slice(0, dot))) {
+          omitted.add(column);
+          break;
+        }
+        dot = column.indexOf(".", dot + 1);
+      }
+    }
+    const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };
     }