@stonyx/orm 0.2.1-beta.86 → 0.2.1-beta.88

package/dist/postgres/postgres-db.js

@@ -56,20 +56,20 @@ export default class PostgresDB {
         const files = await this.deps.getMigrationFiles(migrationsPath);
         const pending = files.filter(f => !applied.includes(f));
         if (pending.length > 0) {
-            this.deps.log.db(`${pending.length} pending migration(s) found.`);
+            this.deps.log.db?.(`${pending.length} pending migration(s) found.`);
             const shouldApply = await this.deps.confirm(`${pending.length} pending migration(s) found. Apply now?`);
             if (shouldApply) {
                 for (const filename of pending) {
                     const content = await this.deps.readFile(this.deps.path.join(migrationsPath, filename));
                     const { up } = this.deps.parseMigrationFile(content);
                     await this.deps.applyMigration(this.requirePool(), filename, up, this.pgConfig.migrationsTable);
-                    this.deps.log.db(`Applied migration: ${filename}`);
+                    this.deps.log.db?.(`Applied migration: ${filename}`);
                 }
                 // Reload records after applying migrations
                 await this.loadMemoryRecords();
             }
             else {
-                this.deps.log.warn('Skipping pending migrations. Schema may be outdated.');
+                this.deps.log.warn?.('Skipping pending migrations. Schema may be outdated.');
             }
         }
         else if (files.length === 0) {
@@ -83,12 +83,12 @@ export default class PostgresDB {
                     if (result) {
                         const { up } = this.deps.parseMigrationFile(result.content);
                         await this.deps.applyMigration(this.requirePool(), result.filename, up, this.pgConfig.migrationsTable);
-                        this.deps.log.db(`Applied migration: ${result.filename}`);
+                        this.deps.log.db?.(`Applied migration: ${result.filename}`);
                         await this.loadMemoryRecords();
                     }
                 }
                 else {
-                    this.deps.log.warn('Skipping initial migration. Tables may not exist.');
+                    this.deps.log.warn?.('Skipping initial migration. Tables may not exist.');
                 }
             }
         }
@@ -98,8 +98,8 @@ export default class PostgresDB {
         if (Object.keys(snapshot).length > 0) {
             const drift = this.deps.detectSchemaDrift(schemas, snapshot);
             if (drift.hasChanges) {
-                this.deps.log.warn('Schema drift detected: models have changed since the last migration.');
-                this.deps.log.warn('Run `stonyx db:generate-migration` to create a new migration.');
+                this.deps.log.warn?.('Schema drift detected: models have changed since the last migration.');
+                this.deps.log.warn?.('Run `stonyx db:generate-migration` to create a new migration.');
             }
         }
     }
@@ -121,7 +121,7 @@ export default class PostgresDB {
         for (const modelName of order) {
             const { modelClass } = Orm.instance.getRecordClasses(modelName);
             if (modelClass?.memory === false) {
-                this.deps.log.db(`Skipping memory load for '${modelName}' (memory: false)`);
+                this.deps.log.db?.(`Skipping memory load for '${modelName}' (memory: false)`);
                 continue;
             }
             const schema = schemas[modelName];
@@ -136,7 +136,7 @@ export default class PostgresDB {
             catch (error) {
                 // 42P01 = undefined_table (PG equivalent of ER_NO_SUCH_TABLE)
                 if (isDbError(error) && error.code === '42P01') {
-                    this.deps.log.db(`Table '${schema.table}' does not exist yet. Skipping load for '${modelName}'.`);
+                    this.deps.log.db?.(`Table '${schema.table}' does not exist yet. Skipping load for '${modelName}'.`);
                     continue;
                 }
                 throw error;
@@ -147,7 +147,7 @@ export default class PostgresDB {
         for (const [viewName, viewSchema] of Object.entries(viewSchemas)) {
             const { modelClass: viewClass } = Orm.instance.getRecordClasses(viewName);
             if (viewClass?.memory !== true) {
-                this.deps.log.db(`Skipping memory load for view '${viewName}' (memory: false)`);
+                this.deps.log.db?.(`Skipping memory load for view '${viewName}' (memory: false)`);
                 continue;
             }
             const sourceIdType = schemas[viewSchema.source]?.idType || 'number';
@@ -170,7 +170,7 @@ export default class PostgresDB {
             }
             catch (error) {
                 if (isDbError(error) && error.code === '42P01') {
-                    this.deps.log.db(`View '${viewSchema.viewName}' does not exist yet. Skipping load for '${viewName}'.`);
+                    this.deps.log.db?.(`View '${viewSchema.viewName}' does not exist yet. Skipping load for '${viewName}'.`);
                     continue;
                 }
                 throw error;
@@ -250,11 +250,12 @@ export default class PostgresDB {
         }
         if (!schema)
             return [];
-        const { sql, values } = this.deps.buildSelect(schema.table, conditions);
+        const resolvedSchema = schema;
+        const { sql, values } = this.deps.buildSelect(resolvedSchema.table, conditions);
         try {
             const result = await this.requirePool().query(sql, values);
             const records = result.rows.map(row => {
-                const rawData = this._rowToRawData(row, schema);
+                const rawData = this._rowToRawData(row, resolvedSchema);
                 return this.deps.createRecord(modelName, rawData, { isDbRecord: true, serialize: false, transform: false });
             });
             for (const record of records) {

package/dist/postgres/schema-introspector.js

@@ -60,6 +60,8 @@ export function introspectModels() {
         }
         // Build foreign keys from belongsTo relationships
         for (const [relName, targetModelName] of Object.entries(relationships.belongsTo)) {
+            if (!targetModelName)
+                continue;
             const fkColumn = `${relName}_id`;
             foreignKeys[fkColumn] = {
                 references: sanitizeTableName(getPluralName(targetModelName)),
@@ -139,7 +141,8 @@ export function getTopologicalOrder(schemas) {
             return;
         // Visit dependencies (belongsTo targets) first
         for (const targetModelName of Object.values(schema.relationships.belongsTo)) {
-            visit(targetModelName);
+            if (targetModelName)
+                visit(targetModelName);
         }
         order.push(name);
     }
@@ -175,11 +178,13 @@ export function introspectViews() {
             const relInfo = getRelationshipInfo(property);
             if (relInfo?.type === 'belongsTo') {
                 relationships.belongsTo[key] = relInfo.modelName;
-                const fkColumn = `${key}_id`;
-                foreignKeys[fkColumn] = {
-                    references: sanitizeTableName(getPluralName(relInfo.modelName)),
-                    column: 'id',
-                };
+                if (relInfo.modelName) {
+                    const fkColumn = `${key}_id`;
+                    foreignKeys[fkColumn] = {
+                        references: sanitizeTableName(getPluralName(relInfo.modelName)),
+                        column: 'id',
+                    };
+                }
             }
             else if (relInfo?.type === 'hasMany') {
                 relationships.hasMany[key] = relInfo.modelName;

package/dist/postgres/type-map.js

@@ -36,6 +36,9 @@ export function getPgType(attrType, transformFn) {
  * Returns a vector column type for the given dimensions.
  */
 export function getVectorType(dimensions) {
+    if (!Number.isInteger(dimensions) || dimensions < 1 || dimensions > 16000) {
+        throw new Error(`Invalid vector dimensions: ${dimensions}. Must be an integer between 1 and 16000.`);
+    }
     return `vector(${dimensions})`;
 }
 function mysqlTypeToPg(mysqlType) {

package/dist/relationships.js

@@ -10,6 +10,8 @@ export function getRelationships(type, sourceModel, targetModel, relationshipId)
     if (!allRelationships.has(sourceModel))
         allRelationships.set(sourceModel, new Map());
     const modelRelationship = allRelationships.get(sourceModel);
+    if (!modelRelationship)
+        return undefined;
     if (!modelRelationship.has(targetModel))
         modelRelationship.set(targetModel, new Map());
     const relationship = modelRelationship.get(targetModel);

package/dist/setup-rest-server.js

@@ -8,7 +8,7 @@ import { dbKey } from './db.js';
 import { getPluralName } from './plural-registry.js';
 import log from 'stonyx/log';
 export default async function (route, accessPath, metaRoute) {
-    let accessFiles = {};
+    const accessFiles = {};
     try {
         await forEachFileImport(accessPath, (accessClass) => {
             const accessInstance = new accessClass();
@@ -32,8 +32,8 @@ export default async function (route, accessPath, metaRoute) {
         });
     }
     catch (error) {
-        log.error(error instanceof Error ? error.message : String(error));
-        log.warn('You must define a valid access configuration file in order to access ORM generated REST endpoints.');
+        log.error?.(error instanceof Error ? error.message : String(error));
+        log.warn?.('You must define a valid access configuration file in order to access ORM generated REST endpoints.');
     }
     await waitForModule('rest-server');
     // Remove "/" prefix and name mount point accordingly
@@ -46,9 +46,7 @@ export default async function (route, accessPath, metaRoute) {
     }
     // Mount the meta route when metaRoute config is enabled
     if (metaRoute) {
-        log.warn('SECURITY RISK! - Meta route is enabled via metaRoute config. This feature is intended for development purposes only!');
+        log.warn?.('SECURITY RISK! - Meta route is enabled via metaRoute config. This feature is intended for development purposes only!');
         RestServer.instance.mountRoute(MetaRequest, { name });
     }
-    // Cleanup references
-    accessFiles = null;
 }

package/dist/store.js

@@ -245,6 +245,8 @@ export default class Store {
             }];
         while (queue.length > 0) {
             const item = queue.shift();
+            if (!item)
+                break;
             const key = `${item.modelName}:${item.recordId}`;
             if (visited.has(key))
                 continue;

package/dist/timescale/query-builder.d.ts

@@ -1,4 +1,6 @@
 export { validateIdentifier, buildInsert, buildUpdate, buildDelete, buildSelect } from '../postgres/query-builder.js';
+export declare function validateInterval(interval: string, context?: string): string;
+export declare function validateAggregate(expr: string, context?: string): string;
 interface QueryResult {
     sql: string;
     values: unknown[];

package/dist/timescale/query-builder.js

@@ -1,6 +1,20 @@
 // Re-export all base PostgreSQL query builders
 export { validateIdentifier, buildInsert, buildUpdate, buildDelete, buildSelect } from '../postgres/query-builder.js';
 import { validateIdentifier } from '../postgres/query-builder.js';
+const SAFE_INTERVAL = /^\d+\s+(microsecond|millisecond|second|minute|hour|day|week|month|year)s?$/i;
+export function validateInterval(interval, context = 'interval') {
+    if (!interval || typeof interval !== 'string' || !SAFE_INTERVAL.test(interval.trim())) {
+        throw new Error(`Invalid SQL ${context}: "${interval}". Intervals must match pattern like "7 days", "1 hour", "30 minutes".`);
+    }
+    return interval.trim();
+}
+const SAFE_AGGREGATE = /^(COUNT|SUM|AVG|MIN|MAX|FIRST|LAST)\s*\(\s*("?[a-zA-Z_][a-zA-Z0-9_]*"?|\*)\s*\)\s*(AS\s+"?[a-zA-Z_][a-zA-Z0-9_]*"?)?$/i;
+export function validateAggregate(expr, context = 'aggregate') {
+    if (!expr || typeof expr !== 'string' || !SAFE_AGGREGATE.test(expr.trim())) {
+        throw new Error(`Invalid SQL ${context}: "${expr}". Aggregates must be simple function calls like "AVG(value) AS avg_value".`);
+    }
+    return expr.trim();
+}
 /**
  * Build a CREATE TABLE + hypertable conversion statement.
  * TimescaleDB hypertables are regular tables converted via create_hypertable().
@@ -9,6 +23,7 @@ export function buildCreateHypertable(table, timeColumn, options = {}) {
     validateIdentifier(table, 'table name');
     validateIdentifier(timeColumn, 'column name');
     const { chunkInterval = '7 days' } = options;
+    validateInterval(chunkInterval, 'chunk interval');
     const sql = `SELECT create_hypertable('"${table}"', '${timeColumn}', chunk_time_interval => INTERVAL '${chunkInterval}', if_not_exists => TRUE)`;
     return { sql, values: [] };
 }
@@ -24,7 +39,7 @@ export function buildTimeBucket(table, timeColumn, bucketSize, options = {}) {
     const selectCols = [`time_bucket($${paramIndex++}, "${timeColumn}") AS bucket`];
     values.push(bucketSize);
     for (const agg of aggregates) {
-        selectCols.push(agg);
+        selectCols.push(validateAggregate(agg));
     }
     const whereClauses = [];
     if (where) {
@@ -35,7 +50,17 @@ export function buildTimeBucket(table, timeColumn, bucketSize, options = {}) {
         }
     }
     const whereStr = whereClauses.length > 0 ? ` WHERE ${whereClauses.join(' AND ')}` : '';
-    const orderStr = orderBy ? ` ORDER BY ${orderBy}` : '';
+    let orderStr = '';
+    if (orderBy) {
+        const parts = orderBy.trim().split(/\s+/);
+        const col = parts[0];
+        const dir = parts[1]?.toUpperCase();
+        validateIdentifier(col, 'ORDER BY column');
+        if (dir && dir !== 'ASC' && dir !== 'DESC') {
+            throw new Error(`Invalid ORDER BY direction: "${dir}". Must be ASC or DESC.`);
+        }
+        orderStr = ` ORDER BY "${col}"${dir ? ` ${dir}` : ''}`;
+    }
     let limitStr = '';
     if (limit != null) {
         limitStr = ` LIMIT $${paramIndex++}`;
@@ -52,6 +77,8 @@ export function buildContinuousAggregate(viewName, table, timeColumn, bucketSize
     validateIdentifier(table, 'table name');
     validateIdentifier(timeColumn, 'column name');
     const { withNoData = false } = options;
+    validateInterval(bucketSize, 'bucket size');
+    aggregates.forEach(agg => validateAggregate(agg));
     const selectCols = [
         `time_bucket('${bucketSize}', "${timeColumn}") AS bucket`,
         ...aggregates,
@@ -65,6 +92,7 @@ export function buildContinuousAggregate(viewName, table, timeColumn, bucketSize
  */
 export function buildCompressionPolicy(table, compressAfter) {
     validateIdentifier(table, 'table name');
+    validateInterval(compressAfter, 'compress after interval');
     const sql = `SELECT add_compression_policy('"${table}"', INTERVAL '${compressAfter}', if_not_exists => TRUE)`;
     return { sql };
 }

package/dist/utils.js

@@ -6,7 +6,8 @@ export function isDbError(error) {
 export function pluralize(word) {
     if (word.includes('-')) {
         const parts = word.split('-');
-        const pluralizedLast = basePluralize(parts.pop());
+        const last = parts.pop();
+        const pluralizedLast = basePluralize(last);
         return [...parts, pluralizedLast].join('-');
     }
     return basePluralize(word);

package/dist/view-resolver.js

@@ -101,7 +101,9 @@ export default class ViewResolver {
             if (!groups.has(key)) {
                 groups.set(key, []);
             }
-            groups.get(key).push(record);
+            const group = groups.get(key);
+            if (group)
+                group.push(record);
         }
         const results = [];
         for (const [groupKey, groupRecords] of groups) {

package/package.json

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.2.1-beta.86",
+  "version": "0.2.1-beta.88",
   "description": "",
   "main": "dist/index.js",
   "type": "module",

package/src/aggregates.ts

@@ -27,13 +27,15 @@ export class AggregateProperty {
       return 0;
     }
 
-    switch (this.aggregateType) {
-      case 'count':
-        return relatedRecords.length;
+    if (this.aggregateType === 'count') return relatedRecords.length;
+
+    const field = this.field;
+    if (!field) return null;
 
+    switch (this.aggregateType) {
       case 'sum':
         return relatedRecords.reduce((acc, record) => {
-          const val = parseFloat(record?.__data?.[this.field!] as string ?? record?.[this.field!] as string);
+          const val = parseFloat(record?.__data?.[field] as string ?? record?.[field] as string);
           return acc + (isNaN(val) ? 0 : val);
         }, 0);
 
@@ -41,7 +43,7 @@ export class AggregateProperty {
         let sum = 0;
         let count = 0;
         for (const record of relatedRecords) {
-          const val = parseFloat(record?.__data?.[this.field!] as string ?? record?.[this.field!] as string);
+          const val = parseFloat(record?.__data?.[field] as string ?? record?.[field] as string);
           if (!isNaN(val)) {
             sum += val;
             count++;
@@ -53,7 +55,7 @@ export class AggregateProperty {
       case 'min': {
         let min: number | null = null;
         for (const record of relatedRecords) {
-          const val = parseFloat(record?.__data?.[this.field!] as string ?? record?.[this.field!] as string);
+          const val = parseFloat(record?.__data?.[field] as string ?? record?.[field] as string);
           if (!isNaN(val) && (min === null || val < min)) min = val;
         }
         return min;
@@ -62,7 +64,7 @@ export class AggregateProperty {
       case 'max': {
         let max: number | null = null;
         for (const record of relatedRecords) {
-          const val = parseFloat(record?.__data?.[this.field!] as string ?? record?.[this.field!] as string);
+          const val = parseFloat(record?.__data?.[field] as string ?? record?.[field] as string);
           if (!isNaN(val) && (max === null || val > max)) max = val;
         }
         return max;

package/src/belongs-to.ts

@@ -4,7 +4,7 @@ import type { SourceRecord } from './types/orm-types.js';
 
 function getOrSet<K, V>(map: Map<K, V>, key: K, defaultValue: V): V {
   if (!map.has(key)) map.set(key, defaultValue);
-  return map.get(key)!;
+  return map.get(key) as V;
 }
 
 interface BelongsToOptions {

package/src/db.ts

@@ -84,7 +84,7 @@ export default class DB {
         const hasData = collectionKeys.some(key => Array.isArray(data[key]) && data[key].length > 0);
 
         if (hasData) {
-          log.error!(`DB mode mismatch: db.json contains data but mode is set to 'directory'. Run migration first:\n\n  stonyx db:migrate-to-directory\n`);
+          log.error?.(`DB mode mismatch: db.json contains data but mode is set to 'directory'. Run migration first:\n\n  stonyx db:migrate-to-directory\n`);
           process.exit(1);
         }
       }
@@ -97,7 +97,7 @@ export default class DB {
         )).some(Boolean);
 
         if (hasCollectionFiles) {
-          log.error!(`DB mode mismatch: directory '${config.orm.db.directory}/' contains collection files but mode is set to 'file'. Run migration first:\n\n  stonyx db:migrate-to-file\n`);
+          log.error?.(`DB mode mismatch: directory '${config.orm.db.directory}/' contains collection files but mode is set to 'file'. Run migration first:\n\n  stonyx db:migrate-to-file\n`);
           process.exit(1);
         }
       }
@@ -176,13 +176,13 @@ export default class DB {
       if (dbFileExists) await updateFile(dbFilePath, skeleton, { json: true });
       else await createFile(dbFilePath, skeleton, { json: true });
 
-      log.db!(`DB has been successfully saved to ${config.orm.db.directory}/ directory`);
+      log.db?.(`DB has been successfully saved to ${config.orm.db.directory}/ directory`);
       return;
     }
 
     await updateFile(`${config.rootPath}/${file}`, jsonData, { json: true });
 
-    log.db!(`DB has been successfully saved to ${file}`);
+    log.db?.(`DB has been successfully saved to ${file}`);
   }
 
   async getRecord(): Promise<DBRecord> {

package/src/hooks.ts

@@ -40,7 +40,8 @@ export function beforeHook(operation: string, model: string, handler: HookHandle
   if (!beforeHooks.has(key)) {
     beforeHooks.set(key, []);
   }
-  beforeHooks.get(key)!.push(handler);
+  const hooks = beforeHooks.get(key);
+  if (hooks) hooks.push(handler);
 
   // Return unsubscribe function
   return () => {
@@ -66,7 +67,8 @@ export function afterHook(operation: string, model: string, handler: HookHandler
   if (!afterHooks.has(key)) {
     afterHooks.set(key, []);
   }
-  afterHooks.get(key)!.push(handler);
+  const hooks = afterHooks.get(key);
+  if (hooks) hooks.push(handler);
 
   // Return unsubscribe function
   return () => {

package/src/main.ts

@@ -187,7 +187,8 @@ export default class Orm {
   static get db(): OrmDB | SqlDb {
     if (!Orm.initialized) throw new Error('ORM has not been initialized yet');
 
-    return Orm.instance.db!;
+    if (!Orm.instance.db) throw new Error('ORM database has not been initialized');
+    return Orm.instance.db;
   }
 
   getRecordClasses(modelName: string): { modelClass: unknown; serializerClass: unknown } {
@@ -218,7 +219,7 @@ export default class Orm {
     this.warnings.add(message);
 
     setTimeout(() => {
-      this.warnings.forEach(warning => log.warn!(warning));
+      this.warnings.forEach(warning => log.warn?.(warning));
       this.warnings.clear();
     }, 0);
   }

package/src/manage-record.ts

@@ -142,8 +142,11 @@ function assignRecordId(modelName: string, rawData: { [key: string]: unknown }):
     return;
   }
 
-  const modelStore = Array.from(store.get(modelName)!.values()) as OrmRecord[];
-  rawData.id = modelStore.length ? (modelStore.at(-1)!.id as number) + 1 : 1;
+  const storeMap = store.get(modelName);
+  if (!storeMap) throw new Error(`Cannot assign record ID: model "${modelName}" not found in store`);
+  const modelStore = Array.from(storeMap.values()) as OrmRecord[];
+  const lastRecord = modelStore.at(-1);
+  rawData.id = lastRecord ? (lastRecord.id as number) + 1 : 1;
 }
 
 function isStringIdModel(modelName: string): boolean {

package/src/mysql/migration-generator.ts

@@ -51,9 +51,12 @@ interface GeneratedMigration {
 type Snapshot = Record<string, SnapshotEntry & { isView?: boolean; viewName?: string; viewQuery?: string; source?: string }>;
 
 export async function generateMigration(description: string = 'migration'): Promise<GeneratedMigration | null> {
-  const { migrationsDir } = config.orm.mysql!;
+  const mysqlConfig = config.orm.mysql;
+  if (!mysqlConfig) throw new Error('MySQL configuration (config.orm.mysql) is required for migration generation');
+  const { migrationsDir } = mysqlConfig;
+  if (!migrationsDir) throw new Error('MySQL migrationsDir is required in config');
   const rootPath = config.rootPath;
-  const migrationsPath = path.resolve(rootPath, migrationsDir!);
+  const migrationsPath = path.resolve(rootPath, migrationsDir);
 
   await createDirectory(migrationsPath);
 
@@ -71,7 +74,7 @@ export async function generateMigration(description: string = 'migration'): Prom
     const viewDiffPrelim = diffViewSnapshots(previousViewSnapshotPrelim, currentViewSnapshotPrelim);
 
     if (!viewDiffPrelim.hasChanges) {
-      log.db!('No schema changes detected.');
+      log.db?.('No schema changes detected.');
       return null;
     }
   }
@@ -104,7 +107,8 @@ export async function generateMigration(description: string = 'migration'): Prom
 
   // Removed columns
   for (const { model, column, type } of diff.removedColumns) {
-    const table = previousSnapshot[model].table!;
+    const table = previousSnapshot[model]?.table;
+    if (!table) throw new Error(`Missing table name in snapshot for model "${model}"`);
     upStatements.push(`ALTER TABLE \`${table}\` DROP COLUMN \`${column}\`;`);
     downStatements.push(`ALTER TABLE \`${table}\` ADD COLUMN \`${column}\` ${type};`);
   }
@@ -130,7 +134,8 @@ export async function generateMigration(description: string = 'migration'): Prom
 
   // Removed foreign keys
   for (const { model, column, references } of diff.removedForeignKeys) {
-    const table = previousSnapshot[model].table!;
+    const table = previousSnapshot[model]?.table;
+    if (!table) throw new Error(`Missing table name in snapshot for model "${model}"`);
     // Resolve FK column type from the referenced table's PK type in previous snapshot
     const refModel = Object.entries(previousSnapshot).find(([, s]) => s.table === references.references);
     const fkType = refModel && refModel[1].idType === 'string' ? 'VARCHAR(255)' : 'INT';
@@ -184,7 +189,7 @@ export async function generateMigration(description: string = 'migration'): Prom
   const combinedHasChanges = diff.hasChanges || viewDiff.hasChanges;
 
   if (!combinedHasChanges) {
-    log.db!('No schema changes detected.');
+    log.db?.('No schema changes detected.');
     return null;
   }
 
@@ -202,7 +207,7 @@ export async function generateMigration(description: string = 'migration'): Prom
   await createFile(path.join(migrationsPath, filename), content);
   await createFile(path.join(migrationsPath, '.snapshot.json'), JSON.stringify(combinedSnapshot, null, 2));
 
-  log.db!(`Migration generated: ${filename}`);
+  log.db?.(`Migration generated: ${filename}`);
 
   return { filename, content, snapshot: combinedSnapshot };
 }

package/src/mysql/migration-runner.ts

@@ -2,6 +2,7 @@ import { readFile, fileExists } from '@stonyx/utils/file';
 import path from 'path';
 import fs from 'fs/promises';
 import type { Pool, PoolConnection } from 'mysql2/promise';
+import { validateIdentifier } from './query-builder.js';
 
 interface ParsedMigration {
   up: string;
@@ -9,6 +10,7 @@ interface ParsedMigration {
 }
 
 export async function ensureMigrationsTable(pool: Pool, tableName: string = '__migrations'): Promise<void> {
+  validateIdentifier(tableName, 'migration table name');
   await pool.execute(`
     CREATE TABLE IF NOT EXISTS \`${tableName}\` (
       id INT AUTO_INCREMENT PRIMARY KEY,
@@ -19,6 +21,7 @@ export async function ensureMigrationsTable(pool: Pool, tableName: string = '__m
 }
 
 export async function getAppliedMigrations(pool: Pool, tableName: string = '__migrations'): Promise<string[]> {
+  validateIdentifier(tableName, 'migration table name');
   const [rows] = await pool.execute(
     `SELECT filename FROM \`${tableName}\` ORDER BY id ASC`
   ) as [Array<{ filename: string }>, unknown];
@@ -56,6 +59,7 @@ export function parseMigrationFile(content: string): ParsedMigration {
 }
 
 export async function applyMigration(pool: Pool, filename: string, upSql: string, tableName: string = '__migrations'): Promise<void> {
+  validateIdentifier(tableName, 'migration table name');
   const connection = await pool.getConnection();
 
   try {
@@ -83,6 +87,7 @@ export async function applyMigration(pool: Pool, filename: string, upSql: string
 }
 
 export async function rollbackMigration(pool: Pool, filename: string, downSql: string, tableName: string = '__migrations'): Promise<void> {
+  validateIdentifier(tableName, 'migration table name');
   const connection = await pool.getConnection();
 
   try {