@carllee1983/dbcli 6.0.0 → 7.0.1

package/dist/core.mjs

@@ -1323,6 +1323,7 @@ var messages_default = {
     unsupported_lang: "Language '{lang}' not supported, using English",
     invalid_json: "Invalid JSON: {message}",
     table_blacklisted: "Error: Table '{table}' is blacklisted for {operation} operations",
+    redis_target_blacklisted: "Redis command refused by blacklist",
     column_blacklisted_write: "Error: {operation} on table '{table}' touches blacklisted columns: {columns}",
     table_already_blacklisted: "Error: Table '{table}' is already blacklisted",
     table_not_in_blacklist: "Error: Table '{table}' is not in the blacklist",
@@ -1414,7 +1415,8 @@ Reference: {referencePath}`,
     columns_omitted: "Security: {count} column(s) were omitted based on your blacklist"
   },
   warnings: {
-    blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'"
+    blacklist_override_used: "Warning: Blacklist override enabled (DBCLI_OVERRIDE_BLACKLIST=true). Executing {operation} on blacklisted table '{table}'",
+    redis_blacklist_override_active: "Warning: Redis blacklist enforcement disabled by DBCLI_OVERRIDE_BLACKLIST=true"
   },
   version: {
     unsupported_warning: "{system} {version} is below minimum supported version {minVersion}. Some features may not work correctly.",
@@ -1637,6 +1639,7 @@ var messages_default2 = {
     unsupported_lang: "\u4E0D\u652F\u63F4\u7684\u8A9E\u8A00 '{lang}'\uFF0C\u4F7F\u7528\u82F1\u6587",
     invalid_json: "\u7121\u6548\u7684 JSON\uFF1A{message}",
     table_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5DF2\u88AB\u9ED1\u540D\u55AE",
+    redis_target_blacklisted: "Redis \u6307\u4EE4\u5DF2\u88AB\u9ED1\u540D\u55AE\u62D2\u7D55",
     column_blacklisted_write: "\u932F\u8AA4: \u8868\u683C '{table}' \u7684 {operation} \u64CD\u4F5C\u5305\u542B\u9ED1\u540D\u55AE\u6B04\u4F4D: {columns}",
     table_already_blacklisted: "\u932F\u8AA4: \u8868\u683C '{table}' \u5DF2\u5728\u9ED1\u540D\u55AE\u4E2D",
     table_not_in_blacklist: "\u932F\u8AA4: \u8868\u683C '{table}' \u4E0D\u5728\u9ED1\u540D\u55AE\u4E2D",
@@ -1728,7 +1731,8 @@ var messages_default2 = {
     columns_omitted: "\u5B89\u5168: {count} \u500B\u6B04\u4F4D\u6839\u64DA\u4F60\u7684\u9ED1\u540D\u55AE\u5DF2\u88AB\u96B1\u85CF"
   },
   warnings: {
-    blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A"
+    blacklist_override_used: "\u8B66\u544A: \u5DF2\u555F\u7528\u9ED1\u540D\u55AE\u8986\u84CB (DBCLI_OVERRIDE_BLACKLIST=true)\u3002\u57F7\u884C {operation} \u5728\u5DF2\u9ED1\u540D\u55AE\u7684\u8868\u683C '{table}' \u4E0A",
+    redis_blacklist_override_active: "\u8B66\u544A: DBCLI_OVERRIDE_BLACKLIST=true \u5DF2\u505C\u7528 Redis \u9ED1\u540D\u55AE\u5F37\u5236\u57F7\u884C"
   },
   version: {
     unsupported_warning: "{system} {version} \u4F4E\u65BC\u6700\u4F4E\u652F\u63F4\u7248\u672C {minVersion}\u3002\u90E8\u5206\u529F\u80FD\u53EF\u80FD\u7121\u6CD5\u6B63\u5E38\u904B\u4F5C\u3002",
@@ -2024,6 +2028,12 @@ var messageLoader = MessageLoader.getInstance();
 var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
+// src/utils/case-fold.ts
+function foldCase(text) {
+  const lowered = (text.includes("\u0130") ? text.replaceAll("\u0130", "i") : text).toLowerCase();
+  return lowered.includes("\u03C2") ? lowered.replaceAll("\u03C2", "\u03C3") : lowered;
+}
+
 // src/utils/glob.ts
 function findClassEnd(glob, open) {
   for (let i = open + 1;i < glob.length; i++) {
@@ -2045,15 +2055,19 @@ function isValidCharacterClass(body) {
   }
 }
 var parsedGlobs = new Map;
-function parseGlob(glob) {
-  const memo = parsedGlobs.get(glob);
+var PARSED_GLOB_LIMIT = 4096;
+function parseGlob(glob, caseInsensitive) {
+  const key = `${caseInsensitive ? "i" : "c"}\x00${glob}`;
+  const memo = parsedGlobs.get(key);
   if (memo !== undefined)
     return memo;
-  const parsed = parseGlobUncached(glob);
-  parsedGlobs.set(glob, parsed);
+  const parsed = parseGlobUncached(glob, caseInsensitive);
+  if (parsedGlobs.size >= PARSED_GLOB_LIMIT)
+    parsedGlobs.clear();
+  parsedGlobs.set(key, parsed);
   return parsed;
 }
-function parseGlobUncached(glob) {
+function parseGlobUncached(glob, caseInsensitive) {
   const runs = [];
   let current = [];
   let leadingStar = false;
@@ -2068,7 +2082,9 @@ function parseGlobUncached(glob) {
     const c = glob[i];
     if (c === "\\" && i + 1 < glob.length) {
       trailingStar = false;
-      current.push({ kind: "literal", char: glob[++i] });
+      const escaped = String.fromCodePoint(glob.codePointAt(++i));
+      i += escaped.length - 1;
+      current.push(...literalToken(escaped, caseInsensitive));
       continue;
     }
     if (c === "*") {
@@ -2088,39 +2104,53 @@ function parseGlobUncached(glob) {
       const end = findClassEnd(glob, i);
       const body = end === -1 ? "" : glob.slice(i, end + 1);
       if (body !== "" && isValidCharacterClass(body)) {
-        current.push({ kind: "class", test: new RegExp(`^${body}$`, "s") });
+        current.push({
+          kind: "class",
+          test: new RegExp(`^${body}$`, caseInsensitive ? "si" : "s")
+        });
         i = end;
         continue;
       }
-      current.push({ kind: "literal", char: "[" });
+      current.push(...literalToken("[", caseInsensitive));
       continue;
     }
-    current.push({ kind: "literal", char: c });
+    const literal = String.fromCodePoint(glob.codePointAt(i));
+    i += literal.length - 1;
+    current.push(...literalToken(literal, caseInsensitive));
   }
   endRun();
   return { runs, leadingStar, trailingStar, anchored: !sawStar };
 }
-function runMatchesAt(run, text, at) {
+function literalToken(codePoint, caseInsensitive) {
+  const folded = caseInsensitive ? foldCase(codePoint) : codePoint;
+  return folded.split("").map((unit) => ({ kind: "literal", char: unit }));
+}
+function runMatchesAt(run, text, raw, at) {
   if (at + run.length > text.length)
     return false;
   for (let i = 0;i < run.length; i++) {
     const token = run[i];
-    const ch = text[at + i];
     if (token.kind === "literal") {
-      if (token.char !== ch)
+      if (token.char !== text[at + i])
         return false;
     } else if (token.kind === "class") {
-      if (!token.test.test(ch))
+      const rawChar = raw[at + i];
+      if (rawChar === undefined) {
+        throw new Error("globMatches: folded and unfolded subject lengths disagree");
+      }
+      if (!token.test.test(rawChar))
         return false;
     }
   }
   return true;
 }
-function globMatches(glob, text) {
-  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob);
+function globMatches(glob, subject, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob, caseInsensitive);
+  const text = caseInsensitive ? foldCase(subject) : subject;
   if (anchored) {
     const run = runs[0] ?? [];
-    return text.length === run.length && runMatchesAt(run, text, 0);
+    return text.length === run.length && runMatchesAt(run, text, subject, 0);
   }
   if (runs.length === 0)
     return true;
@@ -2129,7 +2159,7 @@ function globMatches(glob, text) {
   let last = runs.length;
   if (!leadingStar) {
     const head = runs[0];
-    if (!runMatchesAt(head, text, 0))
+    if (!runMatchesAt(head, text, subject, 0))
       return false;
     cursor = head.length;
     first = 1;
@@ -2137,7 +2167,7 @@ function globMatches(glob, text) {
   if (!trailingStar) {
     const tail = runs[last - 1];
     const at = text.length - tail.length;
-    if (at < cursor || !runMatchesAt(tail, text, at))
+    if (at < cursor || !runMatchesAt(tail, text, subject, at))
       return false;
     last -= 1;
   }
@@ -2146,7 +2176,7 @@ function globMatches(glob, text) {
     const run = runs[r];
     let found = -1;
     for (let at = cursor;at + run.length <= limit; at++) {
-      if (runMatchesAt(run, text, at)) {
+      if (runMatchesAt(run, text, subject, at)) {
         found = at;
         break;
       }
@@ -2157,6 +2187,9 @@ function globMatches(glob, text) {
   }
   return true;
 }
+function isGlobPattern(value) {
+  return /[*?[\\]/.test(value);
+}
 function globNeverMatches(glob) {
   for (let i = 0;i < glob.length; i++) {
     const c = glob[i];
@@ -2180,6 +2213,11 @@ function globNeverMatches(glob) {
   return null;
 }
 
+// src/core/blacklist-fold.ts
+function foldFieldPath(path) {
+  return foldCase(path);
+}
+
 // src/core/mongo/path-matcher.ts
 function compilePatterns(raw) {
   const patterns = [];
@@ -2217,6 +2255,10 @@ function compilePatterns(raw) {
   }
   return { patterns, rejected };
 }
+var FOLD_CASE = { caseInsensitive: true };
+function matchSegment(pattern, segment) {
+  return globMatches(pattern, segment, FOLD_CASE);
+}
 function matchAny(path, patterns) {
   if (patterns.length === 0)
     return false;
@@ -2231,7 +2273,7 @@ function matchAny(path, patterns) {
     }
     let ok = true;
     for (let i = 0;i < pat.segments.length; i++) {
-      if (!globMatches(pat.segments[i], pathSegments[i])) {
+      if (!globMatches(pat.segments[i], pathSegments[i], FOLD_CASE)) {
         ok = false;
         break;
       }
@@ -2241,6 +2283,7 @@ function matchAny(path, patterns) {
   }
   return false;
 }
+var compiledRuleSets = new WeakMap;
 
 // src/core/mongo/request-fields.ts
 var WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
@@ -2691,6 +2734,175 @@ var RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
 
 // src/adapters/redis/value-masker.ts
 var MASKABLE = new Set(["GET", "GETRANGE", "HGETALL", "HGET", "HMGET", "HVALS"]);
+
+// src/core/blacklist-manager.ts
+function isBlacklistOverrideEnabled(value) {
+  return (value ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
+}
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (foldFieldPath(column.slice(0, dot)) !== foldFieldPath(tableKey))
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
+class BlacklistManager {
+  config;
+  state;
+  overrideEnabled;
+  rawTables = [];
+  constructor(config, overrideEnvValue) {
+    this.config = config;
+    this.overrideEnabled = isBlacklistOverrideEnabled(overrideEnvValue);
+    this.state = this.loadBlacklist();
+    this.wildcardTables = this.rawTables.filter(isGlobPattern);
+  }
+  loadBlacklist() {
+    this.rawTables.length = 0;
+    const tables = new Set;
+    const columns = new Map;
+    const blacklistConfig = this.config.blacklist;
+    if (!blacklistConfig) {
+      return { tables, columns };
+    }
+    if (Array.isArray(blacklistConfig.tables)) {
+      for (const tableName of blacklistConfig.tables) {
+        if (typeof tableName === "string") {
+          const entry = normalizeBlacklistEntry(tableName);
+          this.rawTables.push(entry);
+          tables.add(foldFieldPath(entry));
+        } else {
+          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
+        }
+      }
+    } else if (blacklistConfig.tables !== undefined) {
+      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
+    }
+    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
+      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
+        if (typeof tableName !== "string") {
+          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
+          continue;
+        }
+        if (!Array.isArray(cols)) {
+          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
+          continue;
+        }
+        const columnSet = new Set;
+        for (const col of cols) {
+          if (typeof col === "string") {
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
+          } else {
+            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
+          }
+        }
+        if (columnSet.size > 0) {
+          columns.set(foldFieldPath(normalizeBlacklistEntry(tableName)), columnSet);
+        }
+      }
+    } else if (blacklistConfig.columns !== undefined) {
+      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
+    }
+    return { tables, columns };
+  }
+  isTableBlacklisted(tableName) {
+    const name = foldFieldPath(tableName);
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, tableName, { caseInsensitive: true }))
+        return true;
+    }
+    return false;
+  }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = foldFieldPath(normalizeBlacklistEntry(tableName));
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
+  }
+  isColumnBlacklisted(tableName, columnName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return false;
+    }
+    const target = foldFieldPath(normalizeBlacklistEntry(columnName));
+    const compiled = this.foldedColumnsFor(columnSet);
+    if (compiled.literals.has(target))
+      return true;
+    return compiled.globs.length > 0 && matchAny(target, compiled.globs);
+  }
+  foldedColumns = new WeakMap;
+  foldedColumnsFor(columnSet) {
+    const memo = this.foldedColumns.get(columnSet);
+    if (memo !== undefined)
+      return memo;
+    const literals = new Set;
+    const globbed = [];
+    for (const rule of columnSet) {
+      if (isGlobPattern(rule))
+        globbed.push(rule);
+      else
+        literals.add(foldFieldPath(rule));
+    }
+    const folded = {
+      literals,
+      globs: globbed.length > 0 ? compilePatterns(globbed).patterns : []
+    };
+    this.foldedColumns.set(columnSet, folded);
+    return folded;
+  }
+  getBlacklistedColumns(tableName) {
+    const columnSet = this.columnRulesFor(tableName);
+    if (!columnSet) {
+      return [];
+    }
+    return Array.from(columnSet);
+  }
+  getAllBlacklistedColumns() {
+    const all = new Set;
+    for (const columnSet of this.state.columns.values()) {
+      for (const column of columnSet)
+        all.add(column);
+    }
+    return Array.from(all);
+  }
+  canOverrideBlacklist() {
+    return this.overrideEnabled;
+  }
+  getState() {
+    return this.state;
+  }
+}
 // src/utils/sql-lexical.ts
 var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
 var IDENTIFIER_START = /[A-Za-z_]|[\u0080-\uFFFF]/;
@@ -3611,18 +3823,139 @@ function projectRows(rows, selection) {
   const columnNames = collectColumnNames(projectedRows);
   return { rows: normalizeRows(projectedRows, columnNames), columnNames };
 }
-function hasFieldPath(row, segments) {
-  return readPath(row, segments).found;
+function hasFieldPath(row, segments, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const folded = caseInsensitive && options?.alreadyFolded !== true ? segments.map(foldCase) : segments;
+  return readPath(row, folded, caseInsensitive).found;
+}
+function narrow(rules, key) {
+  const parts = key.includes(".") ? key.split(".") : [key];
+  const live = [];
+  for (const rule of rules) {
+    const remaining = rule.segments.length;
+    if (remaining < parts.length && !rule.wildcardTail)
+      continue;
+    let matches = true;
+    for (let i = 0;i < Math.min(remaining, parts.length); i++) {
+      if (!matchSegment(rule.segments[i], parts[i])) {
+        matches = false;
+        break;
+      }
+    }
+    if (!matches)
+      continue;
+    if (remaining <= parts.length)
+      return { drop: true, live: [] };
+    live.push({
+      root: rule.root,
+      rootIndex: rule.rootIndex,
+      offset: rule.offset + parts.length,
+      segments: rule.segments.slice(parts.length),
+      wildcardTail: rule.wildcardTail
+    });
+  }
+  return { drop: false, live };
 }
-function omitFieldPaths(rows, paths) {
-  const topLevel = new Set(paths);
-  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: path.slice(0, path.indexOf(".")), segments: path.split(".") }));
+function liveRulesOf(patterns) {
+  return patterns.map((pattern, index) => ({
+    root: pattern,
+    rootIndex: index,
+    offset: 0,
+    segments: pattern.segments,
+    wildcardTail: pattern.wildcardTail
+  }));
+}
+var NARROW_STATE_LIMIT = 4096;
+
+class NarrowStates {
+  states = [];
+  ids = new Map;
+  transitions = new Map;
+  constructor(rules) {
+    this.intern(rules);
+  }
+  rules(state) {
+    const rules = this.states[state];
+    if (rules === undefined)
+      throw new Error(`unknown nested-rule state ${state}`);
+    return rules;
+  }
+  step(state, key) {
+    const memoKey = `${state}\x00${key}`;
+    const memo = this.transitions.get(memoKey);
+    if (memo !== undefined)
+      return memo;
+    const { drop, live } = narrow(this.rules(state), key);
+    const step = drop ? { drop: true } : { drop: false, next: this.intern(live) };
+    if (this.transitions.size >= NARROW_STATE_LIMIT)
+      this.transitions = new Map;
+    this.transitions.set(memoKey, step);
+    return step;
+  }
+  intern(rules) {
+    const key = rules.map((rule) => `${rule.rootIndex}:${rule.offset}`).join(",");
+    const existing = this.ids.get(key);
+    if (existing !== undefined)
+      return existing;
+    const id = this.states.length;
+    this.states.push(rules);
+    this.ids.set(key, id);
+    return id;
+  }
+}
+function collectNestedMatches(row, states, pending, onMatch) {
+  if (pending.size === 0)
+    return;
+  const walk = (value, state, depth) => {
+    if (pending.size === 0 || states.rules(state).length === 0)
+      return;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        walk(item, state, depth);
+      return;
+    }
+    if (!isPlainRecord(value))
+      return;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const step = states.step(state, key);
+      if (step.drop) {
+        if (depth > 0) {
+          for (const rule of states.rules(state)) {
+            if (!pending.has(rule.root))
+              continue;
+            if (!narrow([rule], key).drop)
+              continue;
+            pending.delete(rule.root);
+            onMatch(rule.root);
+          }
+        }
+        continue;
+      }
+      walk(value[key], step.next, depth + 1);
+    }
+  };
+  walk(row, 0, 0);
+}
+function compileNestedRules(patterns) {
+  return new NarrowStates(liveRulesOf(patterns));
+}
+function omitFieldPaths(rows, paths, options) {
+  const caseInsensitive = options?.caseInsensitive === true;
+  const nestedPatterns = options?.patterns ?? [];
+  const nestedStates = nestedPatterns.length > 0 ? compileNestedRules(nestedPatterns) : undefined;
+  const fold = (value) => caseInsensitive ? foldCase(value) : value;
+  const topLevel = new Set(paths.map(fold));
+  const dotted = paths.filter((path) => path.includes(".")).map((path) => ({ head: fold(path.slice(0, path.indexOf("."))), segments: path.split(".") }));
   const maskRecord = (row) => {
-    let projected = cloneRecord(row, topLevel);
+    let projected = cloneRecord(row, topLevel, caseInsensitive);
     for (const { head, segments } of dotted) {
-      const value = row[head];
-      if (value !== null && typeof value === "object")
-        projected = omitPath(projected, segments);
+      const value = headValue(row, head, caseInsensitive);
+      if (value !== null && typeof value === "object") {
+        projected = omitPath(projected, segments, caseInsensitive);
+      }
+    }
+    if (nestedStates !== undefined && hasNestedRecord(row)) {
+      projected = omitMatching(projected, nestedStates, 0);
     }
     return projected;
   };
@@ -3642,11 +3975,38 @@ function maskArrayRow(row, maskRecord) {
   });
   return out;
 }
-function readPath(value, segments) {
+function headValue(row, head, caseInsensitive) {
+  if (!caseInsensitive)
+    return row[head];
+  const key = foldedKeys(row).get(head);
+  return key === undefined ? undefined : row[key];
+}
+var foldedKeyIndex = new WeakMap;
+function foldedKeys(value) {
+  const memo = foldedKeyIndex.get(value);
+  if (memo !== undefined)
+    return memo;
+  const index = new Map;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    const folded = foldCase(key);
+    if (!index.has(folded))
+      index.set(folded, key);
+  }
+  foldedKeyIndex.set(value, index);
+  return index;
+}
+function ownKey(value, name, caseInsensitive) {
+  if (Object.prototype.hasOwnProperty.call(value, name))
+    return name;
+  if (!caseInsensitive)
+    return;
+  return foldedKeys(value).get(name);
+}
+function readPath(value, segments, caseInsensitive = false) {
   if (segments.length === 0)
     return { found: true, value };
   if (Array.isArray(value)) {
-    const results = value.map((item) => readPath(item, segments));
+    const results = value.map((item) => readPath(item, segments, caseInsensitive));
     return {
       found: results.some((result) => result.found),
       value: results.map((result) => result.found ? result.value : undefined)
@@ -3654,41 +4014,68 @@ function readPath(value, segments) {
   }
   if (!isRecord(value))
     return { found: false };
-  const exactPath = segments.join(".");
-  if (Object.prototype.hasOwnProperty.call(value, exactPath)) {
-    return { found: true, value: value[exactPath] };
-  }
+  const exact = ownKey(value, segments.join("."), caseInsensitive);
+  if (exact !== undefined)
+    return { found: true, value: value[exact] };
   const [head, ...tail] = segments;
-  if (!Object.prototype.hasOwnProperty.call(value, head))
+  const headKey = ownKey(value, head, caseInsensitive);
+  if (headKey === undefined)
     return { found: false };
-  return readPath(value[head], tail);
+  return readPath(value[headKey], tail, caseInsensitive);
 }
-function omitPath(value, segments) {
+function omitMatching(value, states, state) {
+  if (states.rules(state).length === 0)
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => omitMatching(item, states, state));
+  if (!isPlainRecord(value))
+    return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const step = states.step(state, key);
+    if (step.drop)
+      continue;
+    defineData(out, key, omitMatching(child, states, step.next));
+  }
+  return out;
+}
+function hasNestedRecord(row) {
+  for (const key of Object.getOwnPropertyNames(row)) {
+    const value = row[key];
+    if (Array.isArray(value) || isPlainRecord(value))
+      return true;
+  }
+  return false;
+}
+function omitPath(value, segments, caseInsensitive) {
   if (segments.length === 0)
     return value;
   if (Array.isArray(value))
-    return value.map((item) => omitPath(item, segments));
+    return value.map((item) => omitPath(item, segments, caseInsensitive));
   if (!isPlainRecord(value))
     return value;
-  const exactPath = segments.join(".");
-  const [head, ...tail] = segments;
+  const fold = (name) => caseInsensitive ? foldCase(name) : name;
+  const exactPath = fold(segments.join("."));
+  const head = fold(segments[0]);
+  const tail = segments.slice(1);
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (key === exactPath)
+    const folded = fold(key);
+    if (folded === exactPath)
       continue;
-    if (key === head) {
+    if (folded === head) {
       if (tail.length > 0)
-        defineData(out, key, omitPath(child, tail));
+        defineData(out, key, omitPath(child, tail, caseInsensitive));
       continue;
     }
     defineData(out, key, child);
   }
   return out;
 }
-function cloneRecord(value, omittedKeys) {
+function cloneRecord(value, omittedKeys, caseInsensitive = false) {
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (!omittedKeys.has(key))
+    if (!omittedKeys.has(caseInsensitive ? foldCase(key) : key))
       defineData(out, key, child);
   }
   return out;
@@ -3794,12 +4181,12 @@ class QueryExecutor {
       let columnNames = rows.length > 0 && rows[0] ? Object.keys(rows[0]) : [];
       let filteredRows = rows;
       let securityNotification;
-      let omittedColumns = [];
+      let reachesOmitted = () => false;
       if (this.blacklistValidator) {
         const filterResult = this.blacklistValidator.filterColumnsForTables(referencedTables, rows, columnNames);
         filteredRows = filterResult.filteredRows;
         if (filterResult.omittedColumns.length > 0) {
-          omittedColumns = filterResult.omittedColumns;
+          reachesOmitted = filterResult.reachesOmitted;
           columnNames = columnNames.filter((col) => !filterResult.omittedColumns.includes(col));
           securityNotification = this.blacklistValidator.buildSecurityNotification(referencedTables[0] ?? "", filterResult.omittedColumns);
         }
@@ -3807,7 +4194,7 @@ class QueryExecutor {
       if (options?.fieldSelection) {
         const fieldSelection = options.fieldSelection.mode === "include" ? {
           mode: "include",
-          paths: options.fieldSelection.paths.filter((path) => !omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`)))
+          paths: options.fieldSelection.paths.filter((path) => !reachesOmitted(path))
         } : options.fieldSelection;
         const projection = projectRows(filteredRows, fieldSelection);
         filteredRows = projection.rows;
@@ -9203,143 +9590,6 @@ DBCLI_PASSWORD=${password}
     }
   }
 };
-// src/core/blacklist-manager.ts
-function normalizeBlacklistEntry(raw) {
-  const trimmed = raw.trim();
-  const quote = trimmed[0];
-  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
-    return trimmed.slice(1, -1).trim();
-  }
-  return trimmed;
-}
-function assertNotTableQualified(tableKey, column) {
-  const dot = column.indexOf(".");
-  if (dot <= 0)
-    return;
-  if (column.slice(0, dot).toLowerCase() !== tableKey.toLowerCase())
-    return;
-  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
-}
-
-class BlacklistManager {
-  config;
-  state;
-  overrideEnabled;
-  constructor(config, overrideEnvValue) {
-    this.config = config;
-    this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
-    this.state = this.loadBlacklist();
-    this.wildcardTables = [...this.state.tables].filter((entry) => /[*?[\\]/.test(entry));
-  }
-  loadBlacklist() {
-    const tables = new Set;
-    const columns = new Map;
-    const blacklistConfig = this.config.blacklist;
-    if (!blacklistConfig) {
-      return { tables, columns };
-    }
-    if (Array.isArray(blacklistConfig.tables)) {
-      for (const tableName of blacklistConfig.tables) {
-        if (typeof tableName === "string") {
-          tables.add(normalizeBlacklistEntry(tableName).toLowerCase());
-        } else {
-          console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
-        }
-      }
-    } else if (blacklistConfig.tables !== undefined) {
-      console.warn("[BlacklistManager] blacklist.tables must be an array, ignoring");
-    }
-    if (blacklistConfig.columns && typeof blacklistConfig.columns === "object" && !Array.isArray(blacklistConfig.columns)) {
-      for (const [tableName, cols] of Object.entries(blacklistConfig.columns)) {
-        if (typeof tableName !== "string") {
-          console.warn(`[BlacklistManager] Invalid table name key in columns config: ${JSON.stringify(tableName)}`);
-          continue;
-        }
-        if (!Array.isArray(cols)) {
-          console.warn(`[BlacklistManager] blacklist.columns["${tableName}"] must be an array, ignoring`);
-          continue;
-        }
-        const columnSet = new Set;
-        for (const col of cols) {
-          if (typeof col === "string") {
-            const entry = normalizeBlacklistEntry(col);
-            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
-            columnSet.add(entry);
-          } else {
-            console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
-          }
-        }
-        if (columnSet.size > 0) {
-          columns.set(normalizeBlacklistEntry(tableName).toLowerCase(), columnSet);
-        }
-      }
-    } else if (blacklistConfig.columns !== undefined) {
-      console.warn("[BlacklistManager] blacklist.columns must be an object, ignoring");
-    }
-    return { tables, columns };
-  }
-  isTableBlacklisted(tableName) {
-    const name = tableName.toLowerCase();
-    if (this.state.tables.has(name))
-      return true;
-    for (const pattern of this.wildcardTables) {
-      if (globMatches(pattern, name))
-        return true;
-    }
-    return false;
-  }
-  wildcardTables;
-  columnRulesFor(tableName) {
-    const key = normalizeBlacklistEntry(tableName).toLowerCase();
-    const direct = this.state.columns.get(key);
-    if (direct)
-      return direct;
-    const dot = key.lastIndexOf(".");
-    if (dot > 0) {
-      const bare = this.state.columns.get(key.slice(dot + 1));
-      if (bare)
-        return bare;
-    }
-    let merged;
-    for (const [ruleKey, columns] of this.state.columns) {
-      const ruleDot = ruleKey.lastIndexOf(".");
-      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
-        continue;
-      merged ??= new Set;
-      for (const column of columns)
-        merged.add(column);
-    }
-    return merged;
-  }
-  isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.columnRulesFor(tableName);
-    if (!columnSet) {
-      return false;
-    }
-    return columnSet.has(normalizeBlacklistEntry(columnName).toLowerCase());
-  }
-  getBlacklistedColumns(tableName) {
-    const columnSet = this.columnRulesFor(tableName);
-    if (!columnSet) {
-      return [];
-    }
-    return Array.from(columnSet);
-  }
-  getAllBlacklistedColumns() {
-    const all = new Set;
-    for (const columnSet of this.state.columns.values()) {
-      for (const column of columnSet)
-        all.add(column);
-    }
-    return Array.from(all);
-  }
-  canOverrideBlacklist() {
-    return this.overrideEnabled;
-  }
-  getState() {
-    return this.state;
-  }
-}
 // src/utils/es-index-target.ts
 var MAX_DECODE_PASSES = 4;
 function unwrap(target) {
@@ -9381,16 +9631,16 @@ function expandIndexTargets(target) {
   return { concrete, wildcards };
 }
 function matchesIndexGlob(pattern, name) {
-  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
+  const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern;
   try {
-    return globMatches(normalized, name.toLowerCase());
+    return globMatches(normalized, name, { caseInsensitive: true });
   } catch {
     return true;
   }
 }
 function reachesByConvention(name, entry) {
-  const lower = name.toLowerCase();
-  const target = entry.toLowerCase();
+  const lower = foldFieldPath(name);
+  const target = foldFieldPath(entry);
   return new RegExp(`^\\.ds-${escapeRegExp(target)}-`).test(lower) || new RegExp(`^${escapeRegExp(target)}-\\d+$`).test(lower);
 }
 function escapeRegExp(text) {
@@ -9411,11 +9661,13 @@ function indexExpressionReaches(expression, blacklisted) {
     return false;
   const { concrete, wildcards } = expandIndexTargets(expression);
   const entries = expandBlacklistEntries(blacklisted);
-  const reachesName = (name) => entries.names.some((entry) => entry.toLowerCase() === name.toLowerCase() || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
+  const reachesName = (name) => entries.names.some((entry) => foldFieldPath(entry) === foldFieldPath(name) || reachesByConvention(name, entry)) || entries.patterns.some((pattern) => matchesIndexGlob(pattern, name));
   return concrete.some(reachesName) || wildcards.some((pattern) => entries.names.some((entry) => matchesIndexGlob(pattern, entry)) || entries.patterns.length > 0);
 }
 
 // src/core/blacklist-validator.ts
+var FOLD_CASE2 = { caseInsensitive: true };
+var PRE_FOLDED = { caseInsensitive: true, alreadyFolded: true };
 function flattenArrayRow(row) {
   const records = [];
   for (const item of row) {
@@ -9430,7 +9682,7 @@ function dedupe2(values) {
   const seen = new Set;
   const result = [];
   for (const value of values) {
-    const key = value.toLowerCase();
+    const key = foldFieldPath(value);
     if (value.length === 0 || seen.has(key))
       continue;
     seen.add(key);
@@ -9438,11 +9690,14 @@ function dedupe2(values) {
   }
   return result;
 }
-function compileGlobRules(rules, fold, table, operation) {
-  const globbed = rules.filter((rule) => /[*?[\\]/.test(rule));
+function omittedByName(omittedColumns, path) {
+  return omittedColumns.some((omitted) => path === omitted || path.startsWith(`${omitted}.`));
+}
+function compileGlobRules(rules, table, operation) {
+  const globbed = rules.filter(isGlobPattern);
   if (globbed.length === 0)
     return [];
-  const { patterns, rejected } = compilePatterns(globbed.map(fold));
+  const { patterns, rejected } = compilePatterns(globbed);
   if (rejected.length > 0) {
     const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
     throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
@@ -9506,10 +9761,10 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const protectedPaths = new Set(blacklisted.map((name) => name.toLowerCase()));
-    const globs = compileGlobRules(blacklisted, (value) => value.toLowerCase(), tableName, operation);
+    const protectedPaths = new Set(blacklisted.map(foldFieldPath));
+    const globs = compileGlobRules(blacklisted, tableName, operation);
     const conflicts = fields.filter((field) => {
-      const name = field.toLowerCase();
+      const name = foldFieldPath(field);
       if (protectedPaths.has(name))
         return true;
       if (matchAny(name, globs))
@@ -9552,7 +9807,7 @@ class BlacklistValidator {
     const tables = dedupe2(tableNames);
     const blacklistedColumns = tables.length === 0 ? this.manager.getAllBlacklistedColumns() : Array.from(new Set(tables.flatMap((table) => this.manager.getBlacklistedColumns(table))));
     if (blacklistedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
     const probeNested = blacklistedColumns.some((path) => path.includes("."));
     const presentColumns = new Set(columnList);
@@ -9564,7 +9819,7 @@ class BlacklistValidator {
           continue;
         const value = record[key];
         if (value !== null && typeof value === "object")
-          nestedHeads.add(key);
+          nestedHeads.add(foldFieldPath(key));
       }
     };
     for (const row of rows) {
@@ -9577,35 +9832,54 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const foldHead = (path) => {
-      const dot = path.indexOf(".");
-      return dot < 0 ? path.toLowerCase() : path.slice(0, dot).toLowerCase() + path.slice(dot);
-    };
-    const protectedPaths = new Set(blacklistedColumns.map(foldHead));
-    const globRules = compileGlobRules(blacklistedColumns, foldHead, tables[0] ?? "unknown", "SELECT");
+    const protectedPaths = new Set(blacklistedColumns.map(foldFieldPath));
+    const globRules = compileGlobRules(blacklistedColumns, tables[0] ?? "unknown", "SELECT");
     const presentByFolded = new Map;
-    for (const column of presentColumns)
-      presentByFolded.set(foldHead(column), column);
+    for (const column of presentColumns) {
+      const folded = foldFieldPath(column);
+      const names = presentByFolded.get(folded);
+      if (names === undefined)
+        presentByFolded.set(folded, [column]);
+      else
+        names.push(column);
+    }
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      const present = presentByFolded.get(foldHead(path));
+      const present = presentByFolded.get(foldFieldPath(path));
       if (present !== undefined) {
-        omitted.add(present);
+        for (const name of present)
+          omitted.add(name);
         continue;
       }
       const dot = path.indexOf(".");
       if (dot < 0)
         continue;
-      if (!nestedHeads.has(path.slice(0, dot)))
+      if (!nestedHeads.has(foldFieldPath(path.slice(0, dot))))
         continue;
-      const segments = path.split(".");
-      if (rows.some((row) => hasFieldPath(row, segments)))
+      const segments = path.split(".").map(foldFieldPath);
+      if (rows.some((row) => hasFieldPath(row, segments, PRE_FOLDED)))
         omitted.add(path);
     }
+    const nestedGlobs = globRules.filter((pattern) => pattern.segments.length > 1);
+    const matchedNested = [];
+    if (nestedGlobs.length > 0 && nestedHeads.size > 0) {
+      const pending = new Set(nestedGlobs);
+      const states = compileNestedRules(nestedGlobs);
+      for (const row of rows) {
+        if (pending.size === 0)
+          break;
+        if (row === null || typeof row !== "object")
+          continue;
+        collectNestedMatches(row, states, pending, (pattern) => {
+          matchedNested.push(pattern);
+          omitted.add(pattern.raw);
+        });
+      }
+    }
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot).toLowerCase())) {
+        if (dot > 0 && protectedPaths.has(foldFieldPath(column.slice(0, dot)))) {
           omitted.add(column);
           break;
         }
@@ -9614,7 +9888,7 @@ class BlacklistValidator {
     }
     if (globRules.length > 0) {
       for (const column of presentColumns) {
-        const folded = foldHead(column);
+        const folded = foldFieldPath(column);
         if (matchAny(folded, globRules)) {
           omitted.add(column);
           continue;
@@ -9631,10 +9905,30 @@ class BlacklistValidator {
     }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
-      return { filteredRows: rows, omittedColumns: [] };
+      return { filteredRows: rows, omittedColumns: [], reachesOmitted: () => false };
     }
-    const filteredRows = omitFieldPaths(rows, omittedColumns);
-    return { filteredRows, omittedColumns };
+    const removalPaths = matchedNested.length === 0 ? omittedColumns : omittedColumns.filter((path) => !matchedNested.some((p) => p.raw === path));
+    const filteredRows = omitFieldPaths(rows, removalPaths, matchedNested.length > 0 ? { ...FOLD_CASE2, patterns: matchedNested } : FOLD_CASE2);
+    return {
+      filteredRows,
+      omittedColumns,
+      reachesOmitted: (path) => {
+        if (omittedByName(removalPaths, path))
+          return true;
+        if (matchedNested.length === 0)
+          return false;
+        const folded = foldFieldPath(path);
+        if (matchAny(folded, matchedNested))
+          return true;
+        let dot = folded.indexOf(".");
+        while (dot > 0) {
+          if (matchAny(folded.slice(0, dot), matchedNested))
+            return true;
+          dot = folded.indexOf(".", dot + 1);
+        }
+        return false;
+      }
+    };
   }
   buildSecurityNotification(_tableName, omittedColumns) {
     if (omittedColumns.length === 0) {