@carllee1983/dbcli 4.0.0 → 7.0.0

package/dist/core.mjs

@@ -1323,6 +1323,7 @@ var messages_default = {
     unsupported_lang: "Language '{lang}' not supported, using English",
     invalid_json: "Invalid JSON: {message}",
     table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
+    redis_target_blacklisted: "Redis command refused by blacklist",
     column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
     table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
     table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
@@ -1414,7 +1415,8 @@ Reference: {referencePath}`,
     columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
   },
   warnings: {
-    blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'"
+    blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
+    redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
   },
   version: {
     unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
@@ -1637,6 +1639,7 @@ var messages_default2 = {
     unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
     invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
     table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
+    redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
     column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
     table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
     table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
@@ -1728,7 +1731,8 @@ var messages_default2 = {
     columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
   },
   warnings: {
-    blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A"
+    blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
+    redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
   },
   version: {
     unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
@@ -2024,6 +2028,263 @@ var messageLoader = MessageLoader.getInstance();
 var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
+// src/utils/case-fold.ts
+function foldCase(text) {
+  const lowered = (text.includes("\u0130") ? text.replaceAll("\u0130", "i") : text).toLowerCase();
+  return lowered.includes("\u03C2") ? lowered.replaceAll("\u03C2", "\u03C3") : lowered;
+}
+
+// src/utils/glob.ts
+function findClassEnd(glob, open) {
+  for (let i = open + 1;i < glob.length; i++) {
+    if (glob[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (glob[i] === "]")
+      return i;
+  }
+  return -1;
+}
+function isValidCharacterClass(body) {
+  try {
+    new RegExp(body);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var parsedGlobs = new Map;
+var PARSED_GLOB_LIMIT = 4096;
+function parseGlob(glob, caseInsensitive) {
+  const key = `${caseInsensitive ? "i" : "c"}\x00${glob}`;
+  const memo = parsedGlobs.get(key);
+  if (memo !== undefined)
+    return memo;
+  const parsed = parseGlobUncached(glob, caseInsensitive);
+  if (parsedGlobs.size >= PARSED_GLOB_LIMIT)
+    parsedGlobs.clear();
+  parsedGlobs.set(key, parsed);
+  return parsed;
+}
+function parseGlobUncached(glob, caseInsensitive) {
+  const runs = [];
+  let current = [];
+  let leadingStar = false;
+  let trailingStar = false;
+  let sawStar = false;
+  const endRun = () => {
+    if (current.length > 0)
+      runs.push(current);
+    current = [];
+  };
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      trailingStar = false;
+      const escaped = String.fromCodePoint(glob.codePointAt(++i));
+      i += escaped.length - 1;
+      current.push(...literalToken(escaped, caseInsensitive));
+      continue;
+    }
+    if (c === "*") {
+      if (!sawStar && current.length === 0)
+        leadingStar = true;
+      sawStar = true;
+      trailingStar = true;
+      endRun();
+      continue;
+    }
+    trailingStar = false;
+    if (c === "?") {
+      current.push({ kind: "any" });
+      continue;
+    }
+    if (c === "[") {
+      const end = findClassEnd(glob, i);
+      const body = end === -1 ? "" : glob.slice(i, end + 1);
+      if (body !== "" && isValidCharacterClass(body)) {
+        current.push({
+          kind: "class",
+          test: new RegExp(`^${body}$`, caseInsensitive ? "si" : "s")
+        });
+        i = end;
+        continue;
+      }
+      current.push(...literalToken("[", caseInsensitive));
+      continue;
+    }
+    const literal = String.fromCodePoint(glob.codePointAt(i));
+    i += literal.length - 1;
+    current.push(...literalToken(literal, caseInsensitive));
+  }
+  endRun();
+  return { runs, leadingStar, trailingStar, anchored: !sawStar };
+}
+function literalToken(codePoint, caseInsensitive) {
+  const folded = caseInsensitive ? foldCase(codePoint) : codePoint;
+  return folded.split("").map((unit) => ({ kind: "literal", char: unit }));
+}
+function runMatchesAt(run, text, raw, at) {
+  if (at + run.length > text.length)
+    return false;
+  for (let i = 0;i < run.length; i++) {
+    const token = run[i];
+    if (token.kind === "literal") {
+      if (token.char !== text[at + i])
+        return false;
+    } else if (token.kind === "class") {
+      const rawChar = raw[at + i];
+      if (rawChar === undefined) {
+        throw new Error("globMatches: folded and unfolded subject lengths disagree");
+      }
+      if (!token.test.test(rawChar))
+        return false;
+    }
+  }
+  return true;
+}
+function globMatches(glob, subject, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob, caseInsensitive);
+  const text = caseInsensitive ? foldCase(subject) : subject;
+  if (anchored) {
+    const run = runs[0] ?? [];
+    return text.length === run.length && runMatchesAt(run, text, subject, 0);
+  }
+  if (runs.length === 0)
+    return true;
+  let cursor = 0;
+  let first = 0;
+  let last = runs.length;
+  if (!leadingStar) {
+    const head = runs[0];
+    if (!runMatchesAt(head, text, subject, 0))
+      return false;
+    cursor = head.length;
+    first = 1;
+  }
+  if (!trailingStar) {
+    const tail = runs[last - 1];
+    const at = text.length - tail.length;
+    if (at < cursor || !runMatchesAt(tail, text, subject, at))
+      return false;
+    last -= 1;
+  }
+  const limit = trailingStar ? text.length : text.length - runs[runs.length - 1].length;
+  for (let r = first;r < last; r++) {
+    const run = runs[r];
+    let found = -1;
+    for (let at = cursor;at + run.length <= limit; at++) {
+      if (runMatchesAt(run, text, subject, at)) {
+        found = at;
+        break;
+      }
+    }
+    if (found === -1)
+      return false;
+    cursor = found + run.length;
+  }
+  return true;
+}
+function isGlobPattern(value) {
+  return /[*?[\\]/.test(value);
+}
+function globNeverMatches(glob) {
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c !== "[")
+      continue;
+    const end = findClassEnd(glob, i);
+    if (end === -1) {
+      return "unclosed character class";
+    }
+    const body = glob.slice(i, end + 1);
+    if (body === "[]" || body === "[^]")
+      return "empty character class matches nothing";
+    if (!isValidCharacterClass(body))
+      return "invalid character class";
+    i = end;
+  }
+  return null;
+}
+
+// src/core/blacklist-fold.ts
+function foldFieldPath(path) {
+  return foldCase(path);
+}
+
+// src/core/mongo/path-matcher.ts
+function compilePatterns(raw) {
+  const patterns = [];
+  const rejected = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      rejected.push({ raw: String(entry ?? ""), reason: "must be a non-empty string" });
+      continue;
+    }
+    const segments = entry.split(".");
+    if (segments.some((s) => s.length === 0)) {
+      rejected.push({ raw: entry, reason: "empty path segment" });
+      continue;
+    }
+    const globstar = segments.find((seg) => seg.includes("**"));
+    if (globstar !== undefined) {
+      rejected.push({
+        raw: entry,
+        reason: "`**` matches one segment, not a subtree; write `*` or a longer path"
+      });
+      continue;
+    }
+    const dead = segments.map((seg) => globNeverMatches(seg)).find((r) => r !== null);
+    if (dead !== undefined && dead !== null) {
+      rejected.push({ raw: entry, reason: dead });
+      continue;
+    }
+    const wildcardTail = segments.length > 1 && segments[segments.length - 1] === "*";
+    const literal = wildcardTail ? segments.slice(0, -1) : segments;
+    patterns.push({
+      raw: entry,
+      segments: literal,
+      wildcardTail
+    });
+  }
+  return { patterns, rejected };
+}
+var FOLD_CASE = { caseInsensitive: true };
+function matchSegment(pattern, segment) {
+  return globMatches(pattern, segment, FOLD_CASE);
+}
+function matchAny(path, patterns) {
+  if (patterns.length === 0)
+    return false;
+  const pathSegments = path.split(".");
+  for (const pat of patterns) {
+    if (pat.wildcardTail) {
+      if (pathSegments.length < pat.segments.length)
+        continue;
+    } else {
+      if (pat.segments.length !== pathSegments.length)
+        continue;
+    }
+    let ok = true;
+    for (let i = 0;i < pat.segments.length; i++) {
+      if (!globMatches(pat.segments[i], pathSegments[i], FOLD_CASE)) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok)
+      return true;
+  }
+  return false;
+}
+var compiledRuleSets = new WeakMap;
+
 // src/core/mongo/request-fields.ts
 var WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
 var RESHAPES_DOCUMENT = new Set(["$objectToArray", "$replaceRoot", "$replaceWith"]);
@@ -2468,62 +2729,180 @@ var REDIS_COMMAND_TABLE = Object.freeze({
   })
 });
 
-// src/utils/glob.ts
-function globToRegex(glob) {
-  let out = "^";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "\\" && i + 1 < glob.length) {
-      out += glob[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      continue;
+// src/adapters/redis/returned-key-names.ts
+var RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
+
+// src/adapters/redis/value-masker.ts
+var MASKABLE = new Set(["GET", "GETRANGE", "HGETALL", "HGET", "HMGET", "HVALS"]);
+
+// src/core/blacklist-manager.ts
+function isBlacklistOverrideEnabled(value) {
+  return (value ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
+}
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (foldFieldPath(column.slice(0, dot)) !== foldFieldPath(tableKey))
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
+class BlacklistManager {
+  config;
+  state;
+  overrideEnabled;
+  rawTables = [];
+  constructor(config, overrideEnvValue) {
+    this.config = config;
+    this.overrideEnabled = isBlacklistOverrideEnabled(overrideEnvValue);
+    this.state = this.loadBlacklist();
+    this.wildcardTables = this.rawTables.filter(isGlobPattern);
+  }
+  loadBlacklist() {
+    this.rawTables.length = 0;
+    const tables = new Set;
+    const columns = new Map;
+    const blacklistConfig = this.config.blacklist;
+    if (!blacklistConfig) {
+      return { tables, columns };
     }
-    if (c === "*")
-      out += ".*";
-    else if (c === "?")
-      out += ".";
-    else if (c === "[") {
-      const end = findClassEnd(glob, i);
-      const body = end === -1 ? "" : glob.slice(i, end + 1);
-      if (body !== "" && isValidCharacterClass(body)) {
-        out += body;
-        i = end;
-      } else {
-        out += "\\[";
+    if (Array.isArray(blacklistConfig.tables)) {
+      for (const tableName of blacklistConfig.tables) {
+        if (typeof tableName === "string") {
+          const entry = normalizeBlacklistEntry(tableName);
+          this.rawTables.push(entry);
+          tables.add(foldFieldPath(entry));
+        } else {
+          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
+        }
       }
-    } else if (".^$+(){}|\\".includes(c)) {
-      out += "\\" + c;
-    } else {
-      out += c;
+    } else if (blacklistConfig.tables !== undefined) {
+      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
     }
-  }
-  out += "$";
-  return new RegExp(out);
-}
-function findClassEnd(glob, open) {
-  for (let i = open + 1;i < glob.length; i++) {
-    if (glob[i] === "\\") {
-      i++;
-      continue;
+    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
+      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
+        if (typeof tableName !== "string") {
+          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
+          continue;
+        }
+        if (!Array.isArray(cols)) {
+          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
+          continue;
+        }
+        const columnSet = new Set;
+        for (const col of cols) {
+          if (typeof col === "string") {
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
+          } else {
+            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
+          }
+        }
+        if (columnSet.size > 0) {
+          columns.set(foldFieldPath(normalizeBlacklistEntry(tableName)), columnSet);
+        }
+      }
+    } else if (blacklistConfig.columns !== undefined) {
+      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
     }
-    if (glob[i] === "]")
-      return i;
+    return { tables, columns };
   }
-  return -1;
-}
-function isValidCharacterClass(body) {
-  try {
-    new RegExp(body);
-    return true;
-  } catch {
+  isTableBlacklisted(tableName) {
+    const name = foldFieldPath(tableName);
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, tableName, { caseInsensitive: true }))
+        return true;
+    }
     return false;
   }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = foldFieldPath(normalizeBlacklistEntry(tableName));
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
+  }
+  isColumnBlacklisted(tableName, columnName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return false;
+    }
+    const target = foldFieldPath(normalizeBlacklistEntry(columnName));
+    const compiled = this.foldedColumnsFor(columnSet);
+    if (compiled.literals.has(target))
+      return true;
+    return compiled.globs.length > 0 && matchAny(target, compiled.globs);
+  }
+  foldedColumns = new WeakMap;
+  foldedColumnsFor(columnSet) {
+    const memo = this.foldedColumns.get(columnSet);
+    if (memo !== undefined)
+      return memo;
+    const literals = new Set;
+    const globbed = [];
+    for (const rule of columnSet) {
+      if (isGlobPattern(rule))
+        globbed.push(rule);
+      else
+        literals.add(foldFieldPath(rule));
+    }
+    const folded = {
+      literals,
+      globs: globbed.length > 0 ? compilePatterns(globbed).patterns : []
+    };
+    this.foldedColumns.set(columnSet, folded);
+    return folded;
+  }
+  getBlacklistedColumns(tableName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return [];
+    }
+    return Array.from(columnSet);
+  }
+  getAllBlacklistedColumns() {
+    const all = new Set;
+    for (const columnSet of this.state.columns.values()) {
+      for (const column of columnSet)
+        all.add(column);
+    }
+    return Array.from(all);
+  }
+  canOverrideBlacklist() {
+    return this.overrideEnabled;
+  }
+  getState() {
+    return this.state;
+  }
 }
-
-// src/adapters/redis/returned-key-names.ts
-var RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
-
-// src/adapters/redis/value-masker.ts
-var MASKABLE = new Set(["GET", "GETRANGE", "HGETALL", "HGET", "HMGET", "HVALS"]);
 // src/utils/sql-lexical.ts
 var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
 var IDENTIFIER_START = /[A-Za-z_]|[\u0080-\uFFFF]/;
@@ -3444,18 +3823,139 @@ function projectRows(rows, selection) {
   const columnNames = collectColumnNames(projectedRows);
   return { rows: normalizeRows(projectedRows, columnNames), columnNames };
 }
-function hasFieldPath(row, segments) {
-  return readPath(row, segments).found;
+function hasFieldPath(row, segments, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const folded = caseInsensitive && options?.alreadyFolded !== true ? segments.map(foldCase) : segments;
+  return readPath(row, folded, caseInsensitive).found;
+}
+function narrow(rules, key) {
+  const parts = key.includes(".") ? key.split(".") : [key];
+  const live = [];
+  for (const rule of rules) {
+    const remaining = rule.segments.length;
+    if (remaining < parts.length && !rule.wildcardTail)
+      continue;
+    let matches = true;
+    for (let i = 0;i < Math.min(remaining, parts.length); i++) {
+      if (!matchSegment(rule.segments[i], parts[i])) {
+        matches = false;
+        break;
+      }
+    }
+    if (!matches)
+      continue;
+    if (remaining <= parts.length)
+      return { drop: true, live: [] };
+    live.push({
+      root: rule.root,
+      rootIndex: rule.rootIndex,
+      offset: rule.offset + parts.length,
+      segments: rule.segments.slice(parts.length),
+      wildcardTail: rule.wildcardTail
+    });
+  }
+  return { drop: false, live };
+}
+function liveRulesOf(patterns) {
+  return patterns.map((pattern, index) => ({
+    root: pattern,
+    rootIndex: index,
+    offset: 0,
+    segments: pattern.segments,
+    wildcardTail: pattern.wildcardTail
+  }));
 }
-function omitFieldPaths(rows, paths) {
-  const topLevel = new Set(paths);
-  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: path.slice(0, path.indexOf(".")), segments: path.split(".") }));
+var NARROW_STATE_LIMIT = 4096;
+
+class NarrowStates {
+  states = [];
+  ids = new Map;
+  transitions = new Map;
+  constructor(rules) {
+    this.intern(rules);
+  }
+  rules(state) {
+    const rules = this.states[state];
+    if (rules === undefined)
+      throw new Error(`unknown nested-rule state ${state}`);
+    return rules;
+  }
+  step(state, key) {
+    const memoKey = `${state}\x00${key}`;
+    const memo = this.transitions.get(memoKey);
+    if (memo !== undefined)
+      return memo;
+    const { drop, live } = narrow(this.rules(state), key);
+    const step = drop ? { drop: true } : { drop: false, next: this.intern(live) };
+    if (this.transitions.size >= NARROW_STATE_LIMIT)
+      this.transitions = new Map;
+    this.transitions.set(memoKey, step);
+    return step;
+  }
+  intern(rules) {
+    const key = rules.map((rule) => `${rule.rootIndex}:${rule.offset}`).join(",");
+    const existing = this.ids.get(key);
+    if (existing !== undefined)
+      return existing;
+    const id = this.states.length;
+    this.states.push(rules);
+    this.ids.set(key, id);
+    return id;
+  }
+}
+function collectNestedMatches(row, states, pending, onMatch) {
+  if (pending.size === 0)
+    return;
+  const walk = (value, state, depth) => {
+    if (pending.size === 0 || states.rules(state).length === 0)
+      return;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        walk(item, state, depth);
+      return;
+    }
+    if (!isPlainRecord(value))
+      return;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const step = states.step(state, key);
+      if (step.drop) {
+        if (depth > 0) {
+          for (const rule of states.rules(state)) {
+            if (!pending.has(rule.root))
+              continue;
+            if (!narrow([rule], key).drop)
+              continue;
+            pending.delete(rule.root);
+            onMatch(rule.root);
+          }
+        }
+        continue;
+      }
+      walk(value[key], step.next, depth + 1);
+    }
+  };
+  walk(row, 0, 0);
+}
+function compileNestedRules(patterns) {
+  return new NarrowStates(liveRulesOf(patterns));
+}
+function omitFieldPaths(rows, paths, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const nestedPatterns = options?.patterns ?? [];
+  const nestedStates = nestedPatterns.length > 0 ? compileNestedRules(nestedPatterns) : undefined;
+  const fold = (value) => caseInsensitive ? foldCase(value) : value;
+  const topLevel = new Set(paths.map(fold));
+  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: fold(path.slice(0, path.indexOf("."))), segments: path.split(".") }));
   const maskRecord = (row) => {
-    let projected = cloneRecord(row, topLevel);
+    let projected = cloneRecord(row, topLevel, caseInsensitive);
     for (const { head, segments } of dotted) {
-      const value = row[head];
-      if (value !== null && typeof value === "object")
-        projected = omitPath(projected, segments);
+      const value = headValue(row, head, caseInsensitive);
+      if (value !== null && typeof value === "object") {
+        projected = omitPath(projected, segments, caseInsensitive);
+      }
+    }
+    if (nestedStates !== undefined && hasNestedRecord(row)) {
+      projected = omitMatching(projected, nestedStates, 0);
     }
     return projected;
   };
@@ -3475,11 +3975,38 @@ function maskArrayRow(row, maskRecord) {
   });
   return out;
 }
-function readPath(value, segments) {
+function headValue(row, head, caseInsensitive) {
+  if (!caseInsensitive)
+    return row[head];
+  const key = foldedKeys(row).get(head);
+  return key === undefined ? undefined : row[key];
+}
+var foldedKeyIndex = new WeakMap;
+function foldedKeys(value) {
+  const memo = foldedKeyIndex.get(value);
+  if (memo !== undefined)
+    return memo;
+  const index = new Map;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    const folded = foldCase(key);
+    if (!index.has(folded))
+      index.set(folded, key);
+  }
+  foldedKeyIndex.set(value, index);
+  return index;
+}
+function ownKey(value, name, caseInsensitive) {
+  if (Object.prototype.hasOwnProperty.call(value, name))
+    return name;
+  if (!caseInsensitive)
+    return;
+  return foldedKeys(value).get(name);
+}
+function readPath(value, segments, caseInsensitive = false) {
   if (segments.length === 0)
     return { found: true, value };
   if (Array.isArray(value)) {
-    const results = value.map((item) => readPath(item, segments));
+    const results = value.map((item) => readPath(item, segments, caseInsensitive));
     return {
       found: results.some((result) => result.found),
       value: results.map((result) => result.found ? result.value : undefined)
@@ -3487,41 +4014,68 @@ function readPath(value, segments) {
   }
   if (!isRecord(value))
     return { found: false };
-  const exactPath = segments.join(".");
-  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
-    return { found: true, value: value[exactPath] };
-  }
+  const exact = ownKey(value, segments.join("."), caseInsensitive);
+  if (exact !== undefined)
+    return { found: true, value: value[exact] };
   const [head, ...tail] = segments;
-  if (!Object.prototype.hasOwnProperty.call(value, head))
+  const headKey = ownKey(value, head, caseInsensitive);
+  if (headKey === undefined)
     return { found: false };
-  return readPath(value[head], tail);
+  return readPath(value[headKey], tail, caseInsensitive);
+}
+function omitMatching(value, states, state) {
+  if (states.rules(state).length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitMatching(item, states, state));
+  if (!isPlainRecord(value))
+    return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const step = states.step(state, key);
+    if (step.drop)
+      continue;
+    defineData(out, key, omitMatching(child, states, step.next));
+  }
+  return out;
 }
-function omitPath(value, segments) {
+function hasNestedRecord(row) {
+  for (const key of Object.getOwnPropertyNames(row)) {
+    const value = row[key];
+    if (Array.isArray(value) || isPlainRecord(value))
+      return true;
+  }
+  return false;
+}
+function omitPath(value, segments, caseInsensitive) {
   if (segments.length === 0)
     return value;
   if (Array.isArray(value))
-    return value.map((item) => omitPath(item, segments));
+    return value.map((item) => omitPath(item, segments, caseInsensitive));
   if (!isPlainRecord(value))
     return value;
-  const exactPath = segments.join(".");
-  const [head, ...tail] = segments;
+  const fold = (name) => caseInsensitive ? foldCase(name) : name;
+  const exactPath = fold(segments.join("."));
+  const head = fold(segments[0]);
+  const tail = segments.slice(1);
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (key === exactPath)
+    const folded = fold(key);
+    if (folded === exactPath)
       continue;
-    if (key === head) {
+    if (folded === head) {
       if (tail.length > 0)
-        defineData(out, key, omitPath(child, tail));
+        defineData(out, key, omitPath(child, tail, caseInsensitive));
       continue;
     }
     defineData(out, key, child);
   }
   return out;
 }
-function cloneRecord(value, omittedKeys) {
+function cloneRecord(value, omittedKeys, caseInsensitive = false) {
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (!omittedKeys.has(key))
+    if (!omittedKeys.has(caseInsensitive ? foldCase(key) : key))
       defineData(out, key, child);
   }
   return out;
@@ -3627,12 +4181,12 @@ class QueryExecutor {
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
       let filteredRows = rows;
       let securityNotification;
-      let omittedColumns = [];
+      let reachesOmitted = () => false;
       if (this.blacklistValidator) {
         const filterResult = this.blacklistValidator.filterColumnsForTables(referencedTables, rows, columnNames);
         filteredRows = filterResult.filteredRows;
         if (filterResult.omittedColumns.length > 0) {
-          omittedColumns = filterResult.omittedColumns;
+          reachesOmitted = filterResult.reachesOmitted;
           columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
           securityNotification = this.blacklistValidator.buildSecurityNotification(referencedTables[0] ?? "", filterResult.omittedColumns);
         }
@@ -3640,7 +4194,7 @@ class QueryExecutor {
       if (options?.fieldSelection) {
         const fieldSelection = options.fieldSelection.mode === "include" ? {
           mode: "include",
-          paths: options.fieldSelection.paths.filter((path) => !omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`)))
+          paths: options.fieldSelection.paths.filter((path) => !reachesOmitted(path))
         } : options.fieldSelection;
         const projection = projectRows(filteredRows, fieldSelection);
         filteredRows = projection.rows;
@@ -7977,10 +8531,11 @@ var RedisMaskRuleSchema = exports_external.object({
 var RedisConfigSchema = exports_external.object({
   mask: exports_external.array(RedisMaskRuleSchema).default([])
 }).optional();
+var DEFAULT_AUDIT_ROTATION = { max_bytes: 10485760, max_entries: 1e4 };
 var AuditRotationConfigSchema = exports_external.object({
-  max_bytes: exports_external.number().int().positive().default(10485760),
-  max_entries: exports_external.number().int().positive().default(1000)
-}).optional().default({ max_bytes: 10485760, max_entries: 1000 });
+  max_bytes: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_bytes),
+  max_entries: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_entries)
+}).optional().default({ ...DEFAULT_AUDIT_ROTATION });
 var AuditConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true),
   strict: exports_external.boolean().default(false),
@@ -7991,7 +8546,7 @@ var AuditConfigSchema = exports_external.object({
 }).optional().default({
   enabled: true,
   strict: false,
-  rotation: { max_bytes: 10485760, max_entries: 1000 }
+  rotation: { ...DEFAULT_AUDIT_ROTATION }
 });
 var DbcliConfigSchema = exports_external.object({
   connection: ConnectionConfigSchema,
@@ -8509,7 +9064,7 @@ function migrateV1ToV2(v1) {
     schemas: {},
     metadata: v1.metadata ?? { version: "2.0" },
     blacklist: v1.blacklist ?? { tables: [], columns: {} },
-    audit: v1.audit ?? { enabled: true, rotation: { max_bytes: 10485760, max_entries: 1000 } }
+    audit: v1.audit ?? { enabled: true, rotation: { ...DEFAULT_AUDIT_ROTATION } }
   };
 }
 function upsertConnection(config, input) {
@@ -8781,7 +9336,7 @@ var DEFAULT_CONFIG = {
   audit: {
     enabled: true,
     strict: false,
-    rotation: { max_bytes: 10485760, max_entries: 1000 }
+    rotation: { ...DEFAULT_AUDIT_ROTATION }
   }
 };
 function isEnvReference(value) {
@@ -9035,93 +9590,6 @@ DBCLI_PASSWORD=${password}
     }
   }
 };
-// src/core/blacklist-manager.ts
-class BlacklistManager {
-  config;
-  state;
-  overrideEnabled;
-  constructor(config, overrideEnvValue) {
-    this.config = config;
-    this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
-    this.state = this.loadBlacklist();
-  }
-  loadBlacklist() {
-    const tables = new Set;
-    const columns = new Map;
-    const blacklistConfig = this.config.blacklist;
-    if (!blacklistConfig) {
-      return { tables, columns };
-    }
-    if (Array.isArray(blacklistConfig.tables)) {
-      for (const tableName of blacklistConfig.tables) {
-        if (typeof tableName === "string") {
-          tables.add(tableName.toLowerCase());
-        } else {
-          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
-        }
-      }
-    } else if (blacklistConfig.tables !== undefined) {
-      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
-    }
-    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
-      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
-        if (typeof tableName !== "string") {
-          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
-          continue;
-        }
-        if (!Array.isArray(cols)) {
-          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
-          continue;
-        }
-        const columnSet = new Set;
-        for (const col of cols) {
-          if (typeof col === "string") {
-            columnSet.add(col);
-          } else {
-            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
-          }
-        }
-        if (columnSet.size > 0) {
-          columns.set(tableName.toLowerCase(), columnSet);
-        }
-      }
-    } else if (blacklistConfig.columns !== undefined) {
-      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
-    }
-    return { tables, columns };
-  }
-  isTableBlacklisted(tableName) {
-    return this.state.tables.has(tableName.toLowerCase());
-  }
-  isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
-    if (!columnSet) {
-      return false;
-    }
-    return columnSet.has(columnName);
-  }
-  getBlacklistedColumns(tableName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
-    if (!columnSet) {
-      return [];
-    }
-    return Array.from(columnSet);
-  }
-  getAllBlacklistedColumns() {
-    const all = new Set;
-    for (const columnSet of this.state.columns.values()) {
-      for (const column of columnSet)
-        all.add(column);
-    }
-    return Array.from(all);
-  }
-  canOverrideBlacklist() {
-    return this.overrideEnabled;
-  }
-  getState() {
-    return this.state;
-  }
-}
 // src/utils/es-index-target.ts
 var MAX_DECODE_PASSES = 4;
 function unwrap(target) {
@@ -9163,16 +9631,16 @@ function expandIndexTargets(target) {
   return { concrete, wildcards };
 }
 function matchesIndexGlob(pattern, name) {
-  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
+  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern;
   try {
-    return globToRegex(normalized).test(name.toLowerCase());
+    return globMatches(normalized, name, { caseInsensitive: true });
   } catch {
     return true;
   }
 }
 function reachesByConvention(name, entry) {
-  const lower = name.toLowerCase();
-  const target = entry.toLowerCase();
+  const lower = foldFieldPath(name);
+  const target = foldFieldPath(entry);
   return new RegExp(`^\\.ds-${escapeRegExp(target)}-`).test(lower) || new RegExp(`^${escapeRegExp(target)}-\\d+$`).test(lower);
 }
 function escapeRegExp(text) {
@@ -9193,11 +9661,13 @@ function indexExpressionReaches(expression, blacklisted) {
     return false;
   const { concrete, wildcards } = expandIndexTargets(expression);
   const entries = expandBlacklistEntries(blacklisted);
-  const reachesName = (name) => entries.names.some((entry) => entry.toLowerCase() === name.toLowerCase() || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
+  const reachesName = (name) => entries.names.some((entry) => foldFieldPath(entry) === foldFieldPath(name) || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
   return concrete.some(reachesName) || wildcards.some((pattern) => entries.names.some((entry) => matchesIndexGlob(pattern, entry)) || entries.patterns.length > 0);
 }
 
 // src/core/blacklist-validator.ts
+var FOLD_CASE2 = { caseInsensitive: true };
+var PRE_FOLDED = { caseInsensitive: true, alreadyFolded: true };
 function flattenArrayRow(row) {
   const records = [];
   for (const item of row) {
@@ -9212,7 +9682,7 @@ function dedupe2(values) {
   const seen = new Set;
   const result = [];
   for (const value of values) {
-    const key = value.toLowerCase();
+    const key = foldFieldPath(value);
     if (value.length === 0 || seen.has(key))
       continue;
     seen.add(key);
@@ -9220,6 +9690,20 @@ function dedupe2(values) {
   }
   return result;
 }
+function omittedByName(omittedColumns, path) {
+  return omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`));
+}
+function compileGlobRules(rules, table, operation) {
+  const globbed = rules.filter(isGlobPattern);
+  if (globbed.length === 0)
+    return [];
+  const { patterns, rejected } = compilePatterns(globbed);
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
+  }
+  return patterns;
+}
 
 class BlacklistValidator {
   manager;
@@ -9277,7 +9761,27 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const conflicts = fields.filter((f) => blacklisted.includes(f));
+    const protectedPaths = new Set(blacklisted.map(foldFieldPath));
+    const globs = compileGlobRules(blacklisted, tableName, operation);
+    const conflicts = fields.filter((field) => {
+      const name = foldFieldPath(field);
+      if (protectedPaths.has(name))
+        return true;
+      if (matchAny(name, globs))
+        return true;
+      let dot = name.indexOf(".");
+      while (dot >= 0) {
+        if (dot > 0) {
+          const ancestor = name.slice(0, dot);
+          if (protectedPaths.has(ancestor))
+            return true;
+          if (matchAny(ancestor, globs))
+            return true;
+        }
+        dot = name.indexOf(".", dot + 1);
+      }
+      return false;
+    });
     if (conflicts.length === 0) {
       return;
     }
@@ -9303,7 +9807,7 @@ class BlacklistValidator {
     const tables = dedupe2(tableNames);
     const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
     const probeNested = blacklistedColumns.some((path) => path.includes("."));
     const presentColumns = new Set(columnList);
@@ -9315,7 +9819,7 @@ class BlacklistValidator {
           continue;
         const value = record[key];
         if (value !== null && typeof value === "object")
-          nestedHeads.add(key);
+          nestedHeads.add(foldFieldPath(key));
       }
     };
     for (const row of rows) {
@@ -9328,38 +9832,103 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const protectedPaths = new Set(blacklistedColumns);
+    const protectedPaths = new Set(blacklistedColumns.map(foldFieldPath));
+    const globRules = compileGlobRules(blacklistedColumns, tables[0] ?? "unknown", "SELECT");
+    const presentByFolded = new Map;
+    for (const column of presentColumns) {
+      const folded = foldFieldPath(column);
+      const names = presentByFolded.get(folded);
+      if (names === undefined)
+        presentByFolded.set(folded, [column]);
+      else
+        names.push(column);
+    }
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      if (presentColumns.has(path)) {
-        omitted.add(path);
+      const present = presentByFolded.get(foldFieldPath(path));
+      if (present !== undefined) {
+        for (const name of present)
+          omitted.add(name);
         continue;
       }
       const dot = path.indexOf(".");
       if (dot < 0)
         continue;
-      if (!nestedHeads.has(path.slice(0, dot)))
+      if (!nestedHeads.has(foldFieldPath(path.slice(0, dot))))
         continue;
-      const segments = path.split(".");
-      if (rows.some((row) => hasFieldPath(row, segments)))
+      const segments = path.split(".").map(foldFieldPath);
+      if (rows.some((row) => hasFieldPath(row, segments, PRE_FOLDED)))
         omitted.add(path);
     }
+    const nestedGlobs = globRules.filter((pattern) => pattern.segments.length > 1);
+    const matchedNested = [];
+    if (nestedGlobs.length > 0 && nestedHeads.size > 0) {
+      const pending = new Set(nestedGlobs);
+      const states = compileNestedRules(nestedGlobs);
+      for (const row of rows) {
+        if (pending.size === 0)
+          break;
+        if (row === null || typeof row !== "object")
+          continue;
+        collectNestedMatches(row, states, pending, (pattern) => {
+          matchedNested.push(pattern);
+          omitted.add(pattern.raw);
+        });
+      }
+    }
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot))) {
+        if (dot > 0 && protectedPaths.has(foldFieldPath(column.slice(0, dot)))) {
           omitted.add(column);
           break;
         }
         dot = column.indexOf(".", dot + 1);
       }
     }
+    if (globRules.length > 0) {
+      for (const column of presentColumns) {
+        const folded = foldFieldPath(column);
+        if (matchAny(folded, globRules)) {
+          omitted.add(column);
+          continue;
+        }
+        let dot = folded.indexOf(".");
+        while (dot >= 0) {
+          if (dot > 0 && matchAny(folded.slice(0, dot), globRules)) {
+            omitted.add(column);
+            break;
+          }
+          dot = folded.indexOf(".", dot + 1);
+        }
+      }
+    }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
-    const filteredRows = omitFieldPaths(rows, omittedColumns);
-    return { filteredRows, omittedColumns };
+    const removalPaths = matchedNested.length === 0 ? omittedColumns : omittedColumns.filter((path) => !matchedNested.some((p) => p.raw === path));
+    const filteredRows = omitFieldPaths(rows, removalPaths, matchedNested.length > 0 ? { ...FOLD_CASE2, patterns: matchedNested } : FOLD_CASE2);
+    return {
+      filteredRows,
+      omittedColumns,
+      reachesOmitted: (path) => {
+        if (omittedByName(removalPaths, path))
+          return true;
+        if (matchedNested.length === 0)
+          return false;
+        const folded = foldFieldPath(path);
+        if (matchAny(folded, matchedNested))
+          return true;
+        let dot = folded.indexOf(".");
+        while (dot > 0) {
+          if (matchAny(folded.slice(0, dot), matchedNested))
+            return true;
+          dot = folded.indexOf(".", dot + 1);
+        }
+        return false;
+      }
+    };
   }
   buildSecurityNotification(_tableName, omittedColumns) {
     if (omittedColumns.length === 0) {