@rvoh/dream 2.17.1 → 2.18.0

package/dist/esm/src/dream/QueryDriver/Kysely.js

@@ -14,6 +14,7 @@ import DreamCLI from '../../cli/index.js';
 import { CHECK_VIOLATION, COLUMN_OVERFLOW, INVALID_INPUT_SYNTAX, NOT_NULL_VIOLATION, pgErrorType, } from '../../db/errors.js';
 import syncDbTypesFiles from '../../db/helpers/syncDbTypesFiles.js';
 import { default as _db } from '../../db/index.js';
+import validateColumn from '../../db/validators/validateColumn.js';
 import associationToGetterSetterProp from '../../decorators/field/association/associationToGetterSetterProp.js';
 import PackageManager from '../../dream-app/helpers/PackageManager.js';
 import DreamApp from '../../dream-app/index.js';
@@ -551,6 +552,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         // that can exceed 63 bytes. Short aliases like "pluck0" avoid this entirely.
         const shortAliases = [];
         fields.forEach((field, index) => {
+            this.validatePlainColumn(this.dreamClass, field);
             const shortAlias = `pluck${index}`;
             shortAliases.push(shortAlias);
             //  namespace the selection so that when plucking the same column name from
@@ -719,6 +721,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         });
         if (this.query['orderStatements'].length && !bypassOrder) {
             this.query['orderStatements'].forEach(orderStatement => {
+                this.validatePlainColumn(this.dreamClass, orderStatement.column);
                 kyselyQuery = kyselyQuery.orderBy(this.namespaceColumn(orderStatement.column), this.orderByDirection(orderStatement.direction));
             });
         }
@@ -1034,6 +1037,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         if (query['whereStatements'].length ||
             query['whereNotStatements'].length ||
             query['whereAnyStatements'].length) {
+            this.validateBaseWhereStatementColumns(query);
             kyselyQuery = kyselyQuery.where((eb) => eb.and([
                 ...this.aliasWhereStatements(query['whereStatements'], query['baseSqlAlias']).map(whereStatement => this.whereStatementToExpressionWrapper(this.dreamClass, eb, whereStatement, {
                     disallowSimilarityOperator: false,
@@ -1368,6 +1372,66 @@ export default class KyselyQueryDriver extends QueryDriverBase {
     namespaceColumn(column, alias = this.query['baseSqlAlias']) {
         return namespaceColumn(column, alias);
     }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01): when a runtime column identifier is a
+     * plain, un-namespaced column name, validate it against the owning model's
+     * compiled schema so an unknown identifier throws a Dream `InvalidColumnName`
+     * error before it reaches the database (rather than surfacing as a raw
+     * Postgres error or a silent blind-ordering side-channel).
+     *
+     * Only bare identifiers are validated. Namespaced / table-aliased /
+     * association-namespaced identifiers (anything containing a `.`) are left on
+     * their existing path, because the segment before the `.` may be an
+     * association alias or table alias rather than a schema table name, and
+     * validating those safely is not possible here without risking rejection of
+     * currently-valid input.
+     */
+    validatePlainColumn(dreamClass, column) {
+        if (typeof column !== 'string')
+            return;
+        if (column.includes('.'))
+            return;
+        validateColumn(dreamClass.prototype.schema, dreamClass.table, column);
+    }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01) for the base model's dynamic `where` keys.
+     * These are the un-namespaced keys the developer passed to `where` /
+     * `whereNot` / `whereAny` on the root query (validated here, before
+     * `aliasWhereStatement` namespaces them with the base alias). Only plain
+     * column keys are validated. Deliberately skips:
+     *   - namespaced keys (contain a `.`) — the developer explicitly namespaced
+     *     them (e.g. `{ 'users.email': ... }` or a joined table), and the prefix
+     *     may be an association/table alias rather than a schema table name;
+     *   - association-name keys (e.g. `where({ user: userInstance })`), which are
+     *     resolved to foreign keys, not columns;
+     *   - `DreamConst.passthrough` / `DreamConst.required` sentinel values, whose
+     *     keys are resolved elsewhere.
+     *
+     * Join-and / association where statements (which target other tables and are
+     * pre-namespaced) are left on their existing path.
+     */
+    validateBaseWhereStatementColumns(query) {
+        const dreamClass = query['dreamClass'];
+        const whereStatements = [
+            ...query['whereStatements'],
+            ...query['whereNotStatements'],
+            ...query['whereAnyStatements'].flat(),
+        ];
+        whereStatements.forEach(whereStatement => Object.keys(whereStatement).forEach(attr => {
+            if (attr.includes('.'))
+                return;
+            const val = whereStatement[attr];
+            if (val === DreamConst.passthrough || val === DreamConst.required)
+                return;
+            if (dreamClass.associationNames.includes(attr))
+                return;
+            validateColumn(dreamClass.prototype.schema, dreamClass.table, attr);
+        }));
+    }
     /**
      * @internal
      *
@@ -1924,8 +1988,19 @@ export default class KyselyQueryDriver extends QueryDriverBase {
                     scopesQuery = tempQuery;
             }
         }
-        if (scopesQuery['whereStatements'].length) {
-            join = join.on((eb) => eb.and(scopesQuery['whereStatements'].flatMap(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false }))));
+        if (scopesQuery['whereStatements'].length ||
+            scopesQuery['whereNotStatements'].length ||
+            scopesQuery['whereAnyStatements'].length) {
+            // Mirror the base-table clause logic in QueryDriverBase#buildCommon so that default
+            // scopes expressed with whereNot(...)/whereAny(...) — not just where(...) — cross into
+            // association loads (preload/join/leftJoinPreload/innerJoin). Without the whereNot/whereAny
+            // branches below, such default scopes are silently dropped on association loads, leaking
+            // rows the app intended to hide.
+            join = join.on((eb) => eb.and([
+                ...scopesQuery['whereStatements'].map(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false })),
+                ...scopesQuery['whereNotStatements'].map(whereNotStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereNotStatement, tableNameOrAlias), { negate: true })),
+                ...scopesQuery['whereAnyStatements'].map(whereAnyStatements => eb.or(whereAnyStatements.map(whereAnyStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereAnyStatement, tableNameOrAlias))))),
+            ]));
         }
         return join;
     }

package/dist/esm/src/dream-app/index.js

@@ -4,6 +4,7 @@ import validateTable from '../db/validators/validateTable.js';
 import Query from '../dream/Query.js';
 import PostgresQueryDriver from '../dream/QueryDriver/Postgres.js';
 import Encrypt from '../encrypt/index.js';
+import DreamAppInitInvalidEncryptionKey from '../errors/dream-app/DreamAppInitInvalidEncryptionKey.js';
 import DreamAppInitMissingCallToLoadModels from '../errors/dream-app/DreamAppInitMissingCallToLoadModels.js';
 import DreamAppInitMissingMissingProjectRoot from '../errors/dream-app/DreamAppInitMissingMissingProjectRoot.js';
 import DreamAppInitMissingPackageManager from '../errors/dream-app/DreamAppInitMissingPackageManager.js';
@@ -119,7 +120,9 @@ export default class DreamApp {
         if (!this.loadedModels)
             throw new DreamAppInitMissingCallToLoadModels();
         if (this.encryption?.columns?.current)
-            DreamApp.checkKey('columns', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+            DreamApp.checkKey('columns', 'current', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+        if (this.encryption?.columns?.legacy)
+            DreamApp.checkKey('columns', 'legacy', this.encryption.columns.legacy.key, this.encryption.columns.legacy.algorithm);
         if (!DreamAppAllowedPackageManagersEnumValues.includes(this.packageManager) &&
             !EnvInternal.boolean('DREAM_BYPASS_PACKAGE_MANAGER_CHECK'))
             throw new DreamAppInitMissingPackageManager();
@@ -148,22 +151,9 @@ export default class DreamApp {
             await dbDriverClass.setDatabaseTypeParsers(connectionName);
         }
     }
-    static checkKey(encryptionIdentifier, key, algorithm) {
+    static checkKey(encryptionIdentifier, keyType, key, algorithm) {
         if (!Encrypt.validateKey(key, algorithm))
-            // eslint-disable-next-line no-console
-            console.warn(`
-Your current key value for ${encryptionIdentifier} encryption is invalid.
-Try setting it to something valid, like:
-  ${Encrypt.generateKey(algorithm)}
-
-This was done by calling:
-  Encrypt.generateKey('${algorithm}'
-
-A new key can also be generated from the CLI:
-  % pnpm psy g:encryption-key
-  OR
-  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
-`);
+            throw new DreamAppInitInvalidEncryptionKey(encryptionIdentifier, keyType, algorithm);
     }
     /**
      * Returns the cached dream application if it has been set.
@@ -218,6 +208,10 @@ A new key can also be generated from the CLI:
     get paginationPageSize() {
         return this._paginationPageSize;
     }
+    _paginationMaxPageSize = 200;
+    get paginationMaxPageSize() {
+        return this._paginationMaxPageSize;
+    }
     _primaryKeyType = 'bigint';
     get primaryKeyType() {
         return this._primaryKeyType;
@@ -495,6 +489,9 @@ A new key can also be generated from the CLI:
             case 'paginationPageSize':
                 this._paginationPageSize = options;
                 break;
+            case 'paginationMaxPageSize':
+                this._paginationMaxPageSize = options;
+                break;
             default: {
                 // protection so that if a new ApplyOpt is ever added, this will throw a type error at build time
                 const _never = applyOption;

package/dist/esm/src/encrypt/algorithms/aes-gcm/decryptAESGCM.js

@@ -23,8 +23,13 @@ export default function decryptAESGCM(algorithm, encrypted, key) {
     try {
         return JSON.parse(plaintext);
     }
-    catch (cause) {
-        throw Object.assign(new DecryptionParseError(), { cause });
+    catch {
+        // Intentionally drop the underlying SyntaxError as `cause`: its message embeds a
+        // snippet of the just-decrypted plaintext (e.g. `Unexpected token 'x', "secret..." is
+        // not valid JSON`). Carrying it would leak decrypted plaintext into any logger that
+        // serializes `error.cause`. DecryptionParseError's own message is generic and
+        // plaintext-free, which is all callers need to diagnose an encrypted-format mismatch.
+        throw new DecryptionParseError();
     }
 }
 function unpackPayloadOrFail(payload) {

package/dist/esm/src/errors/MaxRecursiveStringCaseDepthExceeded.js

@@ -0,0 +1,14 @@
+export default class MaxRecursiveStringCaseDepthExceeded extends Error {
+    maxDepth;
+    constructor(maxDepth) {
+        super();
+        this.maxDepth = maxDepth;
+    }
+    get message() {
+        return `
+Maximum recursion depth (${this.maxDepth}) exceeded while string-casing an object.
+The input is nested more deeply than Dream will process, which usually means it is
+malformed or maliciously deeply-nested rather than legitimate application data.
+    `;
+    }
+}

package/dist/esm/src/errors/dream-app/DreamAppInitInvalidEncryptionKey.js

@@ -0,0 +1,27 @@
+import Encrypt from '../../encrypt/index.js';
+export default class DreamAppInitInvalidEncryptionKey extends Error {
+    encryptionIdentifier;
+    keyType;
+    algorithm;
+    constructor(encryptionIdentifier, keyType, algorithm) {
+        super();
+        this.encryptionIdentifier = encryptionIdentifier;
+        this.keyType = keyType;
+        this.algorithm = algorithm;
+    }
+    get message() {
+        return `
+Your ${this.keyType} key value for ${this.encryptionIdentifier} encryption is invalid.
+Try setting it to something valid, like:
+  ${Encrypt.generateKey(this.algorithm)}
+
+This was done by calling:
+  Encrypt.generateKey('${this.algorithm}')
+
+A new key can also be generated from the CLI:
+  % pnpm psy g:encryption-key
+  OR
+  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
+`;
+    }
+}

package/dist/esm/src/helpers/cli/generateDreamContent.js

@@ -8,6 +8,7 @@ import snakeify from '../snakeify.js';
 import standardizeFullyQualifiedModelName from '../standardizeFullyQualifiedModelName.js';
 import uniq from '../uniq.js';
 import parseAttribute from './parseAttribute.js';
+import validateStiChildColumns from './validateStiChildColumns.js';
 /**
  * Column names that are automatically emitted by the model generator (and
  * the migration generator). When the user passes any of these explicitly,
@@ -26,6 +27,8 @@ export function filterAutoGeneratedTimestampColumns(columnsWithTypes) {
 }
 export default function generateDreamContent(options) {
     const config = createModelConfig(options);
+    if (config.isSTI)
+        validateStiChildColumns(options.columnsWithTypes);
     // SoftDelete is incompatible with STI children, so it's only applied to
     // non-STI-child models.
     const includeSoftDelete = !config.isSTI && !!options.softDelete;
@@ -59,15 +62,19 @@ export default function generateDreamContent(options) {
         includeDeletedAt: includeSoftDelete || hasExplicitDeletedAt,
     });
     const decoBlock = decoratorsInUse
-        ? `const deco = new Decorators<typeof ${config.modelClassName}>()`
-        : `// Uncomment when adding decorators (@deco.BelongsTo, @deco.Validates, etc.):
+        ? `const deco = new Decorators<typeof ${config.modelClassName}>()
+
+`
+        : config.isSTI
+            ? ''
+            : `// Uncomment when adding decorators (@deco.BelongsTo, @deco.Validates, etc.):
 // import { Decorators } from '@rvoh/dream'
-// const deco = new Decorators<typeof ${config.modelClassName}>()`;
-    return `${importSection}
+// const deco = new Decorators<typeof ${config.modelClassName}>()
 
-${decoBlock}
+`;
+    return `${importSection}
 
-${classDeclaration}
+${decoBlock}${classDeclaration}
 ${tableMethod}${serializersMethod}${fieldsSection}
 }
 `.replace(/^\s*$/gm, '');

package/dist/esm/src/helpers/cli/generateMigrationContent.js

@@ -8,7 +8,8 @@ import globalClassNameFromFullyQualifiedModelName from '../globalClassNameFromFu
 import snakeify from '../snakeify.js';
 import standardizeFullyQualifiedModelName from '../standardizeFullyQualifiedModelName.js';
 const STI_TYPE_COLUMN_NAME = 'type';
-const COLUMNS_TO_INDEX = [STI_TYPE_COLUMN_NAME];
+const DELETED_AT_COLUMN_NAME = 'deleted_at';
+const COLUMNS_TO_INDEX = [STI_TYPE_COLUMN_NAME, DELETED_AT_COLUMN_NAME];
 export default function generateMigrationContent({ connectionName = 'default', table, columnsWithTypes = [], primaryKeyType = 'bigserial', createOrAlter = 'create', stiChildClassName, softDelete = false, } = {}) {
     const altering = createOrAlter === 'alter';
     let requireCitextExtension = false;
@@ -25,8 +26,8 @@ export default function generateMigrationContent({ connectionName = 'default', t
             return name !== 'created_at' && name !== 'updated_at' && name !== 'deleted_at';
         });
     const emitDeletedAtColumn = !altering && (softDelete || userExplicitlyPassedDeletedAt);
-    const { columnDefs, columnDrops, indexDefs, indexDrops } = processedColumnsWithTypes.reduce((acc, attributeDeclaration) => {
-        const { columnDefs, columnDrops, indexDefs, indexDrops } = acc;
+    const { columnDefs, columnDrops, indexDefs } = processedColumnsWithTypes.reduce((acc, attributeDeclaration) => {
+        const { columnDefs, columnDrops, indexDefs } = acc;
         const [rawSegmentOne, _attributeType, ...descriptors] = attributeDeclaration.split(':');
         if (!rawSegmentOne)
             return acc;
@@ -129,13 +130,7 @@ export default function generateMigrationContent({ connectionName = 'default', t
         }
         columnDrops.push(`.dropColumn('${attributeName}')`);
         if (processedAttrType === 'belongsto' || COLUMNS_TO_INDEX.includes(attributeName)) {
-            const indexName = `${table}_${attributeName}`;
-            indexDefs.push(`await db.schema
-    .createIndex('${indexName}')
-    .on('${table}')
-    .column('${attributeName}')
-    .execute()`);
-            indexDrops.push(`await db.schema.dropIndex('${indexName}').execute()`);
+            indexDefs.push(columnIndexStatement(table, attributeName));
         }
         if (stiChildClassName && !userWantsThisOptional && !arrayAttribute && !isBooleanColumn) {
             checkConstraints.push(`
@@ -149,7 +144,10 @@ export default function generateMigrationContent({ connectionName = 'default', t
     .execute()`);
         }
         return acc;
-    }, { columnDefs: [], columnDrops: [], indexDefs: [], indexDrops: [] });
+    }, { columnDefs: [], columnDrops: [], indexDefs: [] });
+    if (emitDeletedAtColumn) {
+        indexDefs.push(columnIndexStatement(table, DELETED_AT_COLUMN_NAME));
+    }
     if (!table) {
         return `\
 import { Kysely, sql } from 'kysely'
@@ -196,7 +194,7 @@ ${citextExtension}${generateEnumStatements(columnsWithTypes)}  await db.schema
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export async function down(db: Kysely<any>): Promise<void> {
-  ${indexDrops.join(newlineIndent)}${indexDrops.length ? newlineIndent : ''}${altering
+  ${altering
         ? `await db.schema${newlineDoubleIndent}.alterTable('${table}')${columnDropLines}.execute()`
         : `await db.schema.dropTable('${table}').execute()`}${generateEnumDropStatements(columnsWithTypes)}
 }\
@@ -393,6 +391,14 @@ function lookupReferencesTable(snakeAssociationName, originalAssociationName) {
 function associationNameToForeignKey(associationName) {
     return snakeify(associationName.replace(/\//g, '_').replace(/_id$/, '') + '_id');
 }
+function columnIndexStatement(table, attributeName) {
+    const indexName = `${table}_${attributeName}`;
+    return `await db.schema
+    .createIndex('${indexName}')
+    .on('${table}')
+    .column('${attributeName}')
+    .execute()`;
+}
 export function optionalFromDescriptors(descriptors) {
     const optional = descriptors.at(-1) === 'optional';
     if (optional)

package/dist/esm/src/helpers/cli/validateStiChildColumns.js

@@ -0,0 +1,7 @@
+import parseAttribute from './parseAttribute.js';
+export default function validateStiChildColumns(columnsWithTypes) {
+    const belongsToColumns = columnsWithTypes.filter(columnWithType => parseAttribute(columnWithType)?.normalizedAttributeType === 'belongsto');
+    if (belongsToColumns.length) {
+        throw new Error(`STI children cannot declare belongs_to associations. Declare associations on the STI parent instead. Unsupported columns: ${belongsToColumns.join(', ')}`);
+    }
+}

package/dist/esm/src/helpers/stringCasing.js

@@ -1,22 +1,34 @@
 import Dream from '../Dream.js';
+import MaxRecursiveStringCaseDepthExceeded from '../errors/MaxRecursiveStringCaseDepthExceeded.js';
 import BaseClockTime from '../utils/datetime/BaseClockTime.js';
 import CalendarDate from '../utils/datetime/CalendarDate.js';
 import { DateTime } from '../utils/datetime/DateTime.js';
 import isObject from './isObject.js';
+// Maximum object-nesting depth `recursiveStringCase` will traverse. Each nesting
+// level recurses once, so without a cap a deeply-nested input (e.g. a malicious
+// ~480KB JSON body under the request size limit) exhausts the call stack and
+// surfaces as an uncontrolled `RangeError` (500). The cap sits far below the
+// point at which this recursion overflows the stack (measured ~2,000+ levels)
+// while remaining far above any legitimate nesting depth, so real application
+// data — request params, serializer output, config objects — is never affected.
+const MAX_RECURSIVE_STRING_CASE_DEPTH = 500;
 export default function stringCase(target, stringCaser) {
     if (typeof target === 'string')
         return stringCaser(target);
-    return recursiveStringCase(target, stringCaser);
+    return recursiveStringCase(target, stringCaser, 0);
 }
-function recursiveStringCase(target, stringCaser) {
+function recursiveStringCase(target, stringCaser, depth) {
     if (target === null)
         return null;
     if (target === undefined)
         return undefined;
     if (typeof target === 'string')
         return target;
+    if (depth >= MAX_RECURSIVE_STRING_CASE_DEPTH) {
+        throw new MaxRecursiveStringCaseDepthExceeded(MAX_RECURSIVE_STRING_CASE_DEPTH);
+    }
     if (Array.isArray(target))
-        return target.map(s => recursiveStringCase(s, stringCaser));
+        return target.map(s => recursiveStringCase(s, stringCaser, depth + 1));
     if (isObject(target)) {
         if (target instanceof DateTime ||
             target instanceof CalendarDate ||
@@ -25,7 +37,7 @@ function recursiveStringCase(target, stringCaser) {
             return target;
         }
         return Object.keys(target).reduce((stringCasedObject, targetKey) => {
-            stringCasedObject[stringCaser(targetKey)] = recursiveStringCase(target[targetKey], stringCaser);
+            stringCasedObject[stringCaser(targetKey)] = recursiveStringCase(target[targetKey], stringCaser, depth + 1);
             return stringCasedObject;
         }, {});
     }

package/dist/types/src/cli/index.d.ts

@@ -14,7 +14,8 @@ export type SpawnOptions = Omit<NodeSpawnOptions, 'shell'> & {
     args?: string[];
 };
 export declare const CLI_INDENT = "                  ";
-export declare const baseColumnsWithTypesDescription = "space separated snake-case (except for belongs_to model name, which may take an @alias suffix to rename the FK) properties like this:\n                      title:citext subtitle:string body_markdown:text style:enum:post_styles:formal,informal User:belongs_to\n                  \n                  all properties default to not nullable; null can be allowed by appending ':optional':\n                      subtitle:string:optional\n                  \n                  supported types:\n                      - uuid:\n                      - uuid[]:\n                          a column optimized for storing UUIDs\n                  \n                      - citext:\n                      - citext[]:\n                          case insensitive text (indexes and queries are automatically case insensitive)\n                  \n                      - encrypted:\n                          encrypted text (used in conjunction with the @deco.Encrypted decorator)\n                  \n                      - string:\n                      - string[]:\n                          varchar; allowed length defaults to 255, but may be customized, e.g.: subtitle:string:128 or subtitle:string:128:optional\n                  \n                      - text\n                      - text[]\n                      - date\n                      - date[]\n                      - datetime\n                      - datetime[]\n                      - time\n                      - time[]\n                      - timetz\n                      - timetz[]\n                      - integer\n                      - integer[]\n                  \n                      - decimal:\n                      - decimal[]:\n                          precision,scale is required, e.g.: volume:decimal:3,2 or volume:decimal:3,2:optional\n                  \n                          leveraging arrays, add the \"[]\" suffix, e.g.: volume:decimal[]:3,2\n                  \n                      - enum:\n                      - enum[]:\n                          include the enum name to automatically create the enum:\n                            type:enum:room_types:bathroom,kitchen,bedroom or type:enum:room_types:bathroom,kitchen,bedroom:optional\n                  \n                          omit the enum values to leverage an existing enum (omits the enum type creation):\n                            type:enum:room_types or type:enum:room_types:optional\n                  \n                          leveraging arrays, add the \"[]\" suffix, e.g.: type:enum[]:room_types:bathroom,kitchen,bedroom";
+export declare const baseColumnsWithTypesDescription = "space separated snake-case properties like this:\n                      title:citext subtitle:string body_markdown:text style:enum:post_styles:formal,informal\n                  \n                  all properties default to not nullable; null can be allowed by appending ':optional':\n                      subtitle:string:optional\n                  \n                  supported types:\n                      - uuid:\n                      - uuid[]:\n                          a column optimized for storing UUIDs\n                  \n                      - citext:\n                      - citext[]:\n                          case insensitive text (indexes and queries are automatically case insensitive)\n                  \n                      - encrypted:\n                          encrypted text (used in conjunction with the @deco.Encrypted decorator)\n                  \n                      - string:\n                      - string[]:\n                          varchar; allowed length defaults to 255, but may be customized, e.g.: subtitle:string:128 or subtitle:string:128:optional\n                  \n                      - text\n                      - text[]\n                      - date\n                      - date[]\n                      - datetime\n                      - datetime[]\n                      - time\n                      - time[]\n                      - timetz\n                      - timetz[]\n                      - integer\n                      - integer[]\n                  \n                      - decimal:\n                      - decimal[]:\n                          precision,scale is required, e.g.: volume:decimal:3,2 or volume:decimal:3,2:optional\n                  \n                          leveraging arrays, add the \"[]\" suffix, e.g.: volume:decimal[]:3,2\n                  \n                      - enum:\n                      - enum[]:\n                          include the enum name to automatically create the enum:\n                            type:enum:room_types:bathroom,kitchen,bedroom or type:enum:room_types:bathroom,kitchen,bedroom:optional\n                  \n                          omit the enum values to leverage an existing enum (omits the enum type creation):\n                            type:enum:room_types or type:enum:room_types:optional\n                  \n                          leveraging arrays, add the \"[]\" suffix, e.g.: type:enum[]:room_types:bathroom,kitchen,bedroom";
+export declare const columnsWithTypesDescriptionForStiChild: string;
 export default class DreamCLI {
     /**
      * Starts the Dream console

package/dist/types/src/dream/Query.d.ts

@@ -846,6 +846,15 @@ export default class Query<DreamInstance extends Dream, QueryTypeOpts extends Re
     static dbDriverClass<T extends Dream>(connectionName: string): typeof QueryDriverBase<T>;
     dbDriverInstance(query?: Query<DreamInstance, any>): QueryDriverBase<DreamInstance>;
     get connectionName(): any;
+    /**
+     * @internal
+     *
+     * Resolves the effective page size for a pagination request: applies the
+     * configured default when no page size is requested, and clamps the result to
+     * the configured maximum (`paginationMaxPageSize`, default 200) so that a
+     * forwarded, attacker-controlled `pageSize` cannot force a full-table load.
+     */
+    private clampedPaginationPageSize;
     /**
      * Paginates the results of your query, accepting a pageSize and page argument,
      * which it uses to segment your query into pages, leveraging limit and offset

package/dist/types/src/dream/QueryDriver/Kysely.d.ts

@@ -362,6 +362,43 @@ export default class KyselyQueryDriver<DreamInstance extends Dream> extends Quer
      * @returns A string
      */
     private namespaceColumn;
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01): when a runtime column identifier is a
+     * plain, un-namespaced column name, validate it against the owning model's
+     * compiled schema so an unknown identifier throws a Dream `InvalidColumnName`
+     * error before it reaches the database (rather than surfacing as a raw
+     * Postgres error or a silent blind-ordering side-channel).
+     *
+     * Only bare identifiers are validated. Namespaced / table-aliased /
+     * association-namespaced identifiers (anything containing a `.`) are left on
+     * their existing path, because the segment before the `.` may be an
+     * association alias or table alias rather than a schema table name, and
+     * validating those safely is not possible here without risking rejection of
+     * currently-valid input.
+     */
+    private validatePlainColumn;
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01) for the base model's dynamic `where` keys.
+     * These are the un-namespaced keys the developer passed to `where` /
+     * `whereNot` / `whereAny` on the root query (validated here, before
+     * `aliasWhereStatement` namespaces them with the base alias). Only plain
+     * column keys are validated. Deliberately skips:
+     *   - namespaced keys (contain a `.`) — the developer explicitly namespaced
+     *     them (e.g. `{ 'users.email': ... }` or a joined table), and the prefix
+     *     may be an association/table alias rather than a schema table name;
+     *   - association-name keys (e.g. `where({ user: userInstance })`), which are
+     *     resolved to foreign keys, not columns;
+     *   - `DreamConst.passthrough` / `DreamConst.required` sentinel values, whose
+     *     keys are resolved elsewhere.
+     *
+     * Join-and / association where statements (which target other tables and are
+     * pre-namespaced) are left on their existing path.
+     */
+    private validateBaseWhereStatementColumns;
     /**
      * @internal
      *

package/dist/types/src/dream-app/index.d.ts

@@ -118,6 +118,8 @@ export default class DreamApp {
     get unicodeNormalization(): UnicodeNormalizationForm;
     private _paginationPageSize;
     get paginationPageSize(): number;
+    private _paginationMaxPageSize;
+    get paginationMaxPageSize(): number;
     private _primaryKeyType;
     get primaryKeyType(): LegacyCompatiblePrimaryKeyType;
     private _projectRoot;
@@ -219,7 +221,7 @@ export default class DreamApp {
     private requireTestDatabaseClaimSupport;
     load<RT extends 'models' | 'serializers'>(resourceType: RT, resourcePath: string, importCb: (path: string) => Promise<any>): Promise<void>;
     plugin(cb: (app: DreamApp) => void | Promise<void>): void;
-    set<ApplyOpt extends DreamAppSetOption>(applyOption: ApplyOpt, options: ApplyOpt extends 'bypassDeprecationChecks' ? boolean : ApplyOpt extends 'db' ? DreamDbCredentialOptions | string : ApplyOpt extends 'encryption' ? DreamAppEncryptionOptions : ApplyOpt extends 'primaryKeyType' ? LegacyCompatiblePrimaryKeyType : ApplyOpt extends 'importExtension' ? GeneratorImportStyle : ApplyOpt extends 'logger' ? DreamLogger : ApplyOpt extends 'projectRoot' ? string : ApplyOpt extends 'inflections' ? () => void | Promise<void> : ApplyOpt extends 'packageManager' ? DreamAppAllowedPackageManagersEnum : ApplyOpt extends 'paths' ? DreamDirectoryPaths : ApplyOpt extends 'parallelTests' ? number : ApplyOpt extends 'unicodeNormalization' ? UnicodeNormalizationForm : ApplyOpt extends 'paginationPageSize' ? number : never, secondaryOptions?: ApplyOpt extends 'db' ? DreamDbCredentialOptions : never): void;
+    set<ApplyOpt extends DreamAppSetOption>(applyOption: ApplyOpt, options: ApplyOpt extends 'bypassDeprecationChecks' ? boolean : ApplyOpt extends 'db' ? DreamDbCredentialOptions | string : ApplyOpt extends 'encryption' ? DreamAppEncryptionOptions : ApplyOpt extends 'primaryKeyType' ? LegacyCompatiblePrimaryKeyType : ApplyOpt extends 'importExtension' ? GeneratorImportStyle : ApplyOpt extends 'logger' ? DreamLogger : ApplyOpt extends 'projectRoot' ? string : ApplyOpt extends 'inflections' ? () => void | Promise<void> : ApplyOpt extends 'packageManager' ? DreamAppAllowedPackageManagersEnum : ApplyOpt extends 'paths' ? DreamDirectoryPaths : ApplyOpt extends 'parallelTests' ? number : ApplyOpt extends 'unicodeNormalization' ? UnicodeNormalizationForm : ApplyOpt extends 'paginationPageSize' ? number : ApplyOpt extends 'paginationMaxPageSize' ? number : never, secondaryOptions?: ApplyOpt extends 'db' ? DreamDbCredentialOptions : never): void;
     on<T extends DreamHookEventType>(hookEventType: T, cb: T extends 'db:log' ? (event: KyselyLogEvent) => void : T extends 'repl:start' ? (context: Context) => void | Promise<void> : never): void;
 }
 export type DreamHookEventType = 'db:log' | 'repl:start';
@@ -232,7 +234,7 @@ export interface DreamAppOpts {
     serializerCasing?: DreamSerializerCasing;
     parallelTests: number | undefined;
 }
-export type DreamAppSetOption = 'bypassDeprecationChecks' | 'db' | 'encryption' | 'inflections' | 'importExtension' | 'logger' | 'paths' | 'primaryKeyType' | 'projectRoot' | 'serializerCasing' | 'parallelTests' | 'unicodeNormalization' | 'paginationPageSize' | 'packageManager';
+export type DreamAppSetOption = 'bypassDeprecationChecks' | 'db' | 'encryption' | 'inflections' | 'importExtension' | 'logger' | 'paths' | 'primaryKeyType' | 'projectRoot' | 'serializerCasing' | 'parallelTests' | 'unicodeNormalization' | 'paginationPageSize' | 'paginationMaxPageSize' | 'packageManager';
 export interface DreamDirectoryPaths {
     models?: string;
     serializers?: string;

package/dist/types/src/errors/MaxRecursiveStringCaseDepthExceeded.d.ts

@@ -0,0 +1,5 @@
+export default class MaxRecursiveStringCaseDepthExceeded extends Error {
+    private maxDepth;
+    constructor(maxDepth: number);
+    get message(): string;
+}

package/dist/types/src/errors/dream-app/DreamAppInitInvalidEncryptionKey.d.ts

@@ -0,0 +1,8 @@
+import { EncryptAlgorithm } from '../../encrypt/index.js';
+export default class DreamAppInitInvalidEncryptionKey extends Error {
+    private encryptionIdentifier;
+    private keyType;
+    private algorithm;
+    constructor(encryptionIdentifier: 'columns', keyType: 'current' | 'legacy', algorithm: EncryptAlgorithm);
+    get message(): string;
+}

package/dist/types/src/helpers/cli/validateStiChildColumns.d.ts

@@ -0,0 +1 @@
+export default function validateStiChildColumns(columnsWithTypes: string[]): void;

package/docs/assets/hierarchy.js

@@ -1 +1 @@
-window.hierarchyData = "eJyVksFOAyEQht9lzlgLtmTL0TYmxlg1MXpoeqC7U5eUhQbYmk3TdzfYC9bq0hOEzM/3McwenLXBg1hQzimhlC4JOFxrLIOyxoPYA6U0LkY2CAJeWnTdzKkdulvpEQhslKlAUFYQaJ0GAaWW3qO/rlaDk+pBHRoN5FgBAoKvrmL86nhAoKyVrhwaEAvG2fJAgHGW0B86j7pLbu3h/6q/xICOhjQqxDVxeLY+fDj0+RZnEj0ekcrZOKFOayw3U2t8cFKZ8KaslvGL/kOjc9b5wV/RHIfRTepgdduYpx26tbafOeQfgRweTzs9k0Hem9I2WxnUSuO7CnU8W0mPdwp1laHQe8dFE8HZmMSmEMqLIaF8UnwPCC+GJ9qv3RaPr4+7R+UbGco60/d8OKd9kyLxmNswb7W+ZFROI33Mw+ELlqZu/Q=="
+window.hierarchyData = "eJyVksFOwzAMht/F5zCajqVVjmxCQogBEoLDtEPWejRamkxJOlRNe3cUdglj0OzkyPLv/7PjPVhjvAO+oIyVhFK6JGBxrbDy0mgHfA+U0hC0aBE4vHRo+5mVO7S3wiEQ2EhdA6d5SaCzCjhUSjiH7rpejU6qR41vFZBjBXDwrr4K8qtjgkDVSFVb1MAXOcuXBwI5yyP3h96h6qOuA/6/6i8hoDdZGRBCjBiejfMfFl06xRnFAEdwZeN48mmD1WZqtPNWSO3fpFEifNF/1mitsW70lzSFYZLFDEZ1rX7aoV0r85ni/EOQ4sfiTc+EF/e6Mu1WeLlS+C59E3Ir4fBOoqoTEAZ7XHQRbJyTsBRCWVkQWmST7wNhZXGC/dpv8Th9eD1K1wpfNYm858UJ6yuyScQxN37eKXXJqZxKhjwPhy/b2G8J"