@carllee1983/dbcli 4.0.0 → 7.0.0

package/dist/cli.mjs

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "4.0.0",
+  version: "7.0.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -135,7 +135,9 @@ var package_default = {
   },
   overrides: {
     "brace-expansion": "^5.0.9",
-    postcss: "^8.5.26"
+    browserslist: "^4.28.7",
+    postcss: "^8.5.26",
+    "postcss-selector-parser": "^6.1.3"
   }
 };
 

package/dist/core.d.ts

@@ -540,40 +540,65 @@ declare const SQL_DIALECTS: readonly [
 	"mariadb"
 ];
 type SqlDialect = (typeof SQL_DIALECTS)[number];
-/**
- * Manager class for loading and querying blacklist rules.
- * Instantiate once per CLI invocation.
- */
 export declare class BlacklistManager {
 	private config;
 	private state;
 	private overrideEnabled;
+	/** Table entries as the config wrote them, for the glob scan. */
+	private readonly rawTables;
 	constructor(config: DbcliConfig, overrideEnvValue?: string);
 	/**
 	 * Deserialize config.blacklist JSON into efficient Set/Map structures.
-	 * Case-insensitive table names (stored as lowercase).
-	 * Case-sensitive column names.
+	 * Case-insensitive table names (stored as lowercase). Column entries are
+	 * stored as written and folded where they are compared — see ADR-0018 and
+	 * ADR-0020. Table entries are kept twice: lower-cased in `tables` for the
+	 * exact lookup, and as written in `rawTables` for the glob scan, because
+	 * folding a pattern's text narrows a character class.
 	 *
 	 * @returns BlacklistState with Set<string> for tables, Map<string, Set<string>> for columns
 	 */
 	loadBlacklist(): BlacklistState;
 	/**
 	 * Check if a table is blacklisted.
-	 * Case-insensitive comparison.
+	 *
+	 * Case-insensitive, and each entry is a glob: `secrets*` covers
+	 * `secrets_2026`. The same array is already a glob for Redis keys and
+	 * Elasticsearch index expressions, and one config file gets one answer
+	 * (ADR-0019 Decision 4). `report\*` escapes back to a literal name.
 	 *
 	 * @param tableName Table name to check
 	 * @returns true if the table is blacklisted
 	 */
 	isTableBlacklisted(tableName: string): boolean;
+	/**
+	 * Table entries carrying glob metacharacters.
+	 *
+	 * Computed with `state` rather than lazily: `getState()` hands the same `Set`
+	 * out, and a lazy cache filled after someone added to it would leave `Set.has`
+	 * seeing the new entry and the glob scan not — fail-open, and silently.
+	 * Nothing mutates it today; the point is that nothing can start to.
+	 */
+	private readonly wildcardTables;
 	/**
 	 * Check if a specific column in a table is blacklisted.
-	 * Table name is case-insensitive; column name is case-sensitive.
+	 * Rule and name are compared case-insensitively over the whole dotted path,
+	 * and a rule carrying a wildcard is matched through the shared matcher
+	 * (ADR-0020).
 	 *
 	 * @param tableName Table name
 	 * @param columnName Column name
 	 * @returns true if the column is blacklisted
 	 */
+	/**
+	 * The rules for a table, found by the reference as written and by its last
+	 * segment. `extractTableReferences` keeps a qualified name whole, so a rule
+	 * under `public.users` did not apply to `SELECT * FROM users` and the reverse
+	 * was equally true. ADR-0018 Decision 3.
+	 */
+	private columnRulesFor;
 	isColumnBlacklisted(tableName: string, columnName: string): boolean;
+	private readonly foldedColumns;
+	private foldedColumnsFor;
 	/**
 	 * Get all blacklisted column names for a specific table.
 	 *
@@ -606,6 +631,16 @@ export declare class BlacklistManager {
 interface FilterColumnsResult {
 	filteredRows: Record<string, unknown>[];
 	omittedColumns: string[];
+	/**
+	 * Whether a caller-supplied field path is covered by what was omitted.
+	 *
+	 * `omittedColumns` names a wildcard rule by its text, so a consumer comparing
+	 * strings could not tell that `--fields profile.SS_num` asks for something
+	 * `profile.ss*` removed: the literal form of the same rule dropped the field
+	 * from the output while the wildcard form returned it as `null`. This answers
+	 * with the compiled rule.
+	 */
+	reachesOmitted: (path: string) => boolean;
 }
 /**
  * Validator class for enforcing blacklist rules.