noormme 1.0.0 → 1.0.2

package/dist/cjs/util/security.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Security utilities for NOORMME
+ * Export all security-related functions for easy import
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityPatterns = exports.SecurityGuidelines = exports.validateNumericRange = exports.validateEnum = exports.SafeSQLExamples = exports.SafeSQLKeywords = exports.safeCaseStatement = exports.safeBoolean = exports.safeOrderBy = exports.safeLockMode = exports.safeKeyword = exports.safeOffset = exports.safeLimit = exports.safeOrderDirection = exports.RateLimiter = exports.validateMigrationName = exports.validateOutputDirectory = exports.sanitizeDatabasePath = exports.validateFilePath = exports.validateColumnReference = exports.validateTableReference = exports.validateIdentifier = void 0;
+exports.securityChecklist = securityChecklist;
+// Input validation and sanitization
+var security_validator_js_1 = require("./security-validator.js");
+Object.defineProperty(exports, "validateIdentifier", { enumerable: true, get: function () { return security_validator_js_1.validateIdentifier; } });
+Object.defineProperty(exports, "validateTableReference", { enumerable: true, get: function () { return security_validator_js_1.validateTableReference; } });
+Object.defineProperty(exports, "validateColumnReference", { enumerable: true, get: function () { return security_validator_js_1.validateColumnReference; } });
+Object.defineProperty(exports, "validateFilePath", { enumerable: true, get: function () { return security_validator_js_1.validateFilePath; } });
+Object.defineProperty(exports, "sanitizeDatabasePath", { enumerable: true, get: function () { return security_validator_js_1.sanitizeDatabasePath; } });
+Object.defineProperty(exports, "validateOutputDirectory", { enumerable: true, get: function () { return security_validator_js_1.validateOutputDirectory; } });
+Object.defineProperty(exports, "validateMigrationName", { enumerable: true, get: function () { return security_validator_js_1.validateMigrationName; } });
+Object.defineProperty(exports, "RateLimiter", { enumerable: true, get: function () { return security_validator_js_1.RateLimiter; } });
+// Safe SQL helpers
+var safe_sql_helpers_js_1 = require("./safe-sql-helpers.js");
+Object.defineProperty(exports, "safeOrderDirection", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeOrderDirection; } });
+Object.defineProperty(exports, "safeLimit", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeLimit; } });
+Object.defineProperty(exports, "safeOffset", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeOffset; } });
+Object.defineProperty(exports, "safeKeyword", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeKeyword; } });
+Object.defineProperty(exports, "safeLockMode", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeLockMode; } });
+Object.defineProperty(exports, "safeOrderBy", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeOrderBy; } });
+Object.defineProperty(exports, "safeBoolean", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeBoolean; } });
+Object.defineProperty(exports, "safeCaseStatement", { enumerable: true, get: function () { return safe_sql_helpers_js_1.safeCaseStatement; } });
+Object.defineProperty(exports, "SafeSQLKeywords", { enumerable: true, get: function () { return safe_sql_helpers_js_1.SafeSQLKeywords; } });
+Object.defineProperty(exports, "SafeSQLExamples", { enumerable: true, get: function () { return safe_sql_helpers_js_1.SafeSQLExamples; } });
+Object.defineProperty(exports, "validateEnum", { enumerable: true, get: function () { return safe_sql_helpers_js_1.validateEnum; } });
+Object.defineProperty(exports, "validateNumericRange", { enumerable: true, get: function () { return safe_sql_helpers_js_1.validateNumericRange; } });
+/**
+ * Security best practices and guidelines
+ */
+exports.SecurityGuidelines = {
+    /**
+     * NEVER use sql.raw() or sql.lit() with user input
+     */
+    NEVER_USE_RAW_WITH_USER_INPUT: 'Use safe alternatives or parameterized queries',
+    /**
+     * ALWAYS validate dynamic identifiers
+     */
+    ALWAYS_VALIDATE_IDENTIFIERS: 'Use validateColumnReference() or validateTableReference()',
+    /**
+     * ALWAYS use whitelists for user-controlled values
+     */
+    ALWAYS_USE_WHITELISTS: 'Define allowed values and validate against them',
+    /**
+     * ALWAYS sanitize file paths
+     */
+    ALWAYS_SANITIZE_PATHS: 'Use validateFilePath() or sanitizeDatabasePath()',
+    /**
+     * PREFER parameterized queries
+     */
+    PREFER_PARAMETERIZED_QUERIES: 'Use sql`${value}` instead of sql.raw()',
+    /**
+     * PREFER safe helpers over raw SQL
+     */
+    PREFER_SAFE_HELPERS: 'Use safeOrderDirection(), safeLimit(), etc.',
+};
+/**
+ * Quick security checklist for developers
+ */
+function securityChecklist() {
+    return `
+NOORMME Security Checklist:
+
+✅ Input Validation
+  □ All user inputs validated with whitelists
+  □ Dynamic columns/tables use validateColumnReference()/validateTableReference()
+  □ File paths use validateFilePath() or sanitizeDatabasePath()
+
+✅ SQL Injection Prevention
+  □ No sql.raw() with user input
+  □ No sql.lit() with user input
+  □ Use safe alternatives: safeOrderDirection(), safeLimit(), etc.
+  □ Parameterized queries used for all values
+
+✅ Path Traversal Prevention
+  □ All file operations validated
+  □ No parent directory references (..) allowed
+  □ No absolute paths accepted
+
+✅ Production Readiness
+  □ Environment variables for sensitive config
+  □ Error messages don't leak sensitive info
+  □ Rate limiting enabled for auth endpoints
+  □ Database file permissions set (600/640)
+  □ Dependencies updated regularly
+  □ Backups encrypted and secure
+
+Use this checklist before deploying to production!
+`;
+}
+/**
+ * Common security patterns
+ */
+exports.SecurityPatterns = {
+    /**
+     * Safe column selection from user input
+     */
+    safeColumnSelection: (userColumn, allowedColumns) => {
+        if (!allowedColumns.includes(userColumn)) {
+            throw new Error(`Invalid column: ${userColumn}`);
+        }
+        return userColumn;
+    },
+    /**
+     * Safe table selection from user input
+     */
+    safeTableSelection: (userTable, allowedTables) => {
+        if (!allowedTables.includes(userTable)) {
+            throw new Error(`Invalid table: ${userTable}`);
+        }
+        return userTable;
+    },
+    /**
+     * Safe enum validation
+     */
+    safeEnumValue: (value, allowedValues) => {
+        if (!allowedValues.includes(value)) {
+            throw new Error(`Invalid value: ${value}. Allowed: ${allowedValues.join(', ')}`);
+        }
+        return value;
+    },
+    /**
+     * Safe numeric range validation
+     */
+    safeNumericValue: (value, min, max) => {
+        const num = typeof value === 'string' ? parseFloat(value) : value;
+        if (isNaN(num) || num < min || num > max) {
+            throw new Error(`Invalid number: ${value}. Must be between ${min} and ${max}`);
+        }
+        return num;
+    },
+};

package/dist/cjs/watch/schema-watcher.js

@@ -18,11 +18,13 @@ class SchemaWatcher {
         this.schemaDiscovery = schemaDiscovery;
         this.logger = logger;
         this.options = options;
+        // Merge options, giving priority to explicitly passed values
+        const defaultEnabled = process.env.NODE_ENV === 'development';
         this.options = {
             pollInterval: 5000,
             ignoreViews: true,
             ignoredTables: [],
-            enabled: process.env.NODE_ENV === 'development',
+            enabled: options.enabled !== undefined ? options.enabled : defaultEnabled,
             ...options
         };
     }
@@ -40,29 +42,40 @@ class SchemaWatcher {
         }
         this.logger.info('Starting schema change monitoring...');
         // Get initial schema snapshot
-        const initialSchema = await this.getCurrentSchema();
-        this.lastSchemaHash = this.hashSchema(initialSchema);
+        try {
+            const initialSchema = await this.getCurrentSchema();
+            this.lastSchemaHash = this.hashSchema(initialSchema);
+        }
+        catch (error) {
+            this.logger.error('Failed to get initial schema snapshot:', error);
+            // Set a default hash to allow watching to continue
+            this.lastSchemaHash = '0';
+        }
         this.isWatching = true;
         this.intervalId = setInterval(() => {
             this.checkForChanges().catch(error => {
                 this.logger.error('Error checking for schema changes:', error);
             });
         }, this.options.pollInterval);
+        // Unref the interval to allow the process to exit
+        if (this.intervalId && typeof this.intervalId.unref === 'function') {
+            this.intervalId.unref();
+        }
         this.logger.info(`Schema watcher started (polling every ${this.options.pollInterval}ms)`);
     }
     /**
      * Stop watching for schema changes
      */
     stopWatching() {
-        if (!this.isWatching) {
-            return;
-        }
         if (this.intervalId) {
             clearInterval(this.intervalId);
             this.intervalId = null;
         }
         this.isWatching = false;
-        this.logger.info('Schema watcher stopped');
+        this.callbacks = []; // Clear callbacks on stop
+        if (this.logger) {
+            this.logger.info('Schema watcher stopped');
+        }
     }
     /**
      * Register callback for schema changes
@@ -86,6 +99,8 @@ class SchemaWatcher {
         try {
             const currentSchema = await this.getCurrentSchema();
             const currentHash = this.hashSchema(currentSchema);
+            // Debug logging
+            this.logger.debug(`Schema check - Last hash: ${this.lastSchemaHash}, Current hash: ${currentHash}, Tables: ${currentSchema.tables.length}`);
             if (this.lastSchemaHash && currentHash !== this.lastSchemaHash) {
                 this.logger.info('Schema changes detected, analyzing...');
                 // Since we only have the hash, we'll need to do a full schema comparison
@@ -98,6 +113,10 @@ class SchemaWatcher {
                 }
                 return changes;
             }
+            // Update hash even if no changes detected yet (for first check after initialization)
+            if (!this.lastSchemaHash) {
+                this.lastSchemaHash = currentHash;
+            }
             return [];
         }
         catch (error) {

package/dist/esm/cli/commands/generate.js

@@ -3,11 +3,13 @@ import { promises as fs } from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import { NOORMME } from '../../noormme.js';
+import { sanitizeDatabasePath, validateOutputDirectory } from '../../util/security-validator.js';
 export async function generate(options = {}) {
     console.log(chalk.blue.bold('\n🔧 NOORMME Code Generation - Automating TypeScript & Repositories\n'));
     try {
-        // Initialize NOORMME with database path
-        const databasePath = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        const databasePath = sanitizeDatabasePath(databasePathInput);
         const db = new NOORMME({
             dialect: 'sqlite',
             connection: {
@@ -20,7 +22,9 @@ export async function generate(options = {}) {
         });
         await db.initialize();
         const schemaInfo = await db.getSchemaInfo();
+        // SECURITY: Validate output directory to prevent path traversal attacks
         const outputDir = options.output || './generated';
+        validateOutputDirectory(outputDir);
         const format = options.format || 'dts';
         console.log(chalk.gray(`📁 Output directory: ${outputDir}`));
         console.log(chalk.gray(`📊 Discovered ${schemaInfo.tables.length} tables\n`));
@@ -184,11 +188,11 @@ function mapColumnToTsType(column) {
     }
     // JSON types
     if (type.includes('json')) {
-        return 'Record<string, any>';
+        return 'Record<string, unknown>';
     }
     // Array types
     if (type.includes('array') || type.includes('[]')) {
-        return 'any[]';
+        return 'unknown[]';
     }
     // UUID types
     if (type.includes('uuid')) {
@@ -199,11 +203,11 @@ function mapColumnToTsType(column) {
 }
 function getPrimaryKeyType(table) {
     if (!table.primaryKey || table.primaryKey.length === 0) {
-        return 'any';
+        return 'unknown';
     }
     if (table.primaryKey.length === 1) {
         const pkColumn = table.columns.find(col => col.name === table.primaryKey[0]);
-        return pkColumn ? mapColumnToTsType(pkColumn) : 'any';
+        return pkColumn ? mapColumnToTsType(pkColumn) : 'unknown';
     }
     // Composite primary key
     const types = table.primaryKey.map(pkCol => {

package/dist/esm/cli/commands/init.js

@@ -3,12 +3,17 @@ import inquirer from 'inquirer';
 import { promises as fs } from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
+import { sanitizeDatabasePath, validateOutputDirectory } from '../../util/security-validator.js';
 export async function init(options) {
     console.log(chalk.blue.bold('\n🎯 NOORMME Zero-Configuration Setup\n'));
     console.log(chalk.gray('Setting up NOORMME with complete SQLite automation...\n'));
     try {
-        // Get database path
-        const databasePath = options.database || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || './database.sqlite';
+        const databasePath = sanitizeDatabasePath(databasePathInput);
+        // SECURITY: Validate output directory to prevent path traversal attacks
+        const outputDir = options.output || 'lib';
+        validateOutputDirectory(outputDir);
         console.log(chalk.blue('🔍 Detecting existing SQLite database...'));
         // Check if database exists
         const dbExists = await checkDatabaseExists(databasePath);
@@ -55,7 +60,6 @@ export async function init(options) {
             return;
         }
         // Generate files with automation focus
-        const outputDir = options.output || 'lib';
         await generateDbFile(databasePath, outputDir, options.force, autoOptimize, autoIndex);
         await generateEnvExample(databasePath);
         await generateAutomationConfig(databasePath, autoOptimize, autoIndex);
@@ -120,7 +124,7 @@ async function generateDbFile(databasePath, outputDir, force, autoOptimize, auto
 
 // NOORMME with complete SQLite automation
 // Automatically discovers schema, generates types, and optimizes performance
-export const db = new NOORMME({
+const database = new NOORMME({
   dialect: 'sqlite',
   connection: { database: '${databasePath}' },
   
@@ -154,7 +158,7 @@ export const db = new NOORMME({
 
 // Initialize with complete automation
 export async function initializeDatabase() {
-  await db.initialize()
+  await database.initialize()
   console.log('🎉 NOORMME initialized with complete SQLite automation!')
   console.log('✅ Schema discovered automatically')
   console.log('✅ Types generated automatically')
@@ -163,32 +167,32 @@ export async function initializeDatabase() {
 
 // Get a repository for any table (auto-generated)
 export function getRepository<T>(tableName: string) {
-  return db.getRepository<T>(tableName)
+  return database.getRepository<T>(tableName)
 }
 
 // Get Kysely instance for complex queries
 export function getKysely() {
-  return db.getKysely()
+  return database.getKysely()
 }
 
 // Performance monitoring
 export async function getPerformanceMetrics() {
-  return await db.getSQLitePerformanceMetrics()
+  return await database.getSQLitePerformanceMetrics()
 }
 
 // Get optimization recommendations
 export async function getOptimizationRecommendations() {
-  return await db.getSQLiteIndexRecommendations()
+  return await database.getSQLiteIndexRecommendations()
 }
 
 // Apply optimizations
 export async function applyOptimizations() {
-  return await db.applySQLiteOptimizations()
+  return await database.applySQLiteOptimizations()
 }
 
 // Close database connections
 export async function closeDatabase() {
-  await db.close()
+  await database.close()
 }
 `;
     // Ensure directory exists

package/dist/esm/cli/commands/inspect.js

@@ -1,11 +1,13 @@
 /// <reference types="./inspect.d.ts" />
 import chalk from 'chalk';
 import { NOORMME } from '../../noormme.js';
+import { sanitizeDatabasePath, validateIdentifier } from '../../util/security-validator.js';
 export async function inspect(tableName, options = {}) {
     console.log(chalk.blue.bold('\n🔍 NOORMME Schema Inspection - Intelligent Database Discovery\n'));
     try {
-        // Initialize NOORMME with database path
-        const databasePath = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        const databasePath = sanitizeDatabasePath(databasePathInput);
         const db = new NOORMME({
             dialect: 'sqlite',
             connection: {
@@ -20,6 +22,8 @@ export async function inspect(tableName, options = {}) {
         console.log(chalk.gray(`📁 Database: ${databasePath}\n`));
         const schemaInfo = await db.getSchemaInfo();
         if (tableName) {
+            // SECURITY: Validate table name to prevent SQL injection
+            validateIdentifier(tableName, 'table name');
             // Show specific table with automation insights
             const table = schemaInfo.tables.find(t => t.name === tableName);
             if (!table) {

package/dist/esm/cli/commands/status.js

@@ -210,10 +210,10 @@ async function getAutomationStatus(db) {
     try {
         const config = db.config;
         return {
-            autoOptimization: config.performance?.enableAutoOptimization ?? true,
+            autoOptimization: config.automation?.enableAutoOptimization ?? true,
             queryAnalysis: config.performance?.enableQueryOptimization ?? true,
-            autoIndexing: config.performance?.enableAutoIndexing ?? true,
-            schemaMonitoring: config.watch?.enabled ?? false
+            autoIndexing: config.automation?.enableIndexRecommendations ?? true,
+            schemaMonitoring: config.automation?.enableSchemaWatcher ?? false
         };
     }
     catch {

package/dist/esm/dialect/database-introspector.js

@@ -12,30 +12,24 @@ export class DatabaseIntrospector {
      * Get all tables in the database
      */
     async getTables() {
-        try {
-            // SQLite
-            const sqliteTables = await this.db
-                .selectFrom('sqlite_master')
-                .select('name')
-                .where('type', '=', 'table')
-                .where('name', 'not like', 'sqlite_%')
-                .execute();
-            return sqliteTables.map(t => ({
-                name: t.name
-            }));
-        }
-        catch (error) {
-            console.warn('SQLite table discovery failed:', error);
-            throw new Error('Unable to introspect database tables. SQLite database required.');
-        }
+        // SQLite
+        const sqliteTables = await this.db
+            .selectFrom('sqlite_master')
+            .select('name')
+            .where('type', '=', 'table')
+            .where('name', 'not like', 'sqlite_%')
+            .execute();
+        return sqliteTables.map(t => ({
+            name: t.name
+        }));
     }
     /**
      * Get columns for a specific table
      */
     async getColumns(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_table_info
-            const result = await sql `pragma_table_info(${sql.lit(tableName)})`.execute(this.db);
+            // SQLite - use raw SQL for PRAGMA table_info
+            const result = await sql `PRAGMA table_info(${sql.lit(tableName)})`.execute(this.db);
             const sqliteColumns = result.rows;
             return sqliteColumns.map((col) => ({
                 name: col.name,
@@ -48,7 +42,8 @@ export class DatabaseIntrospector {
         }
         catch (error) {
             console.warn('SQLite column discovery failed:', error);
-            throw new Error(`Unable to introspect columns for table '${tableName}'. SQLite database required.`);
+            // Return empty array instead of throwing for non-existent tables
+            return [];
         }
     }
     /**
@@ -63,8 +58,8 @@ export class DatabaseIntrospector {
      */
     async getForeignKeys(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_foreign_key_list
-            const result = await sql `pragma_foreign_key_list(${sql.lit(tableName)})`.execute(this.db);
+            // SQLite - use raw SQL for PRAGMA foreign_key_list
+            const result = await sql `PRAGMA foreign_key_list(${sql.lit(tableName)})`.execute(this.db);
             const sqliteFks = result.rows;
             return sqliteFks.map((fk) => ({
                 name: `fk_${tableName}_${fk.from}`,

package/dist/esm/dialect/sqlite/sqlite-introspector.js

@@ -38,28 +38,17 @@ export class SqliteIntrospector extends DatabaseIntrospector {
     }
     async #getTableMetadata(options) {
         const tablesResult = await this.#tablesQuery(this.#db, options).execute();
-        const tableMetadata = await this.#db
-            .with('table_list', (qb) => this.#tablesQuery(qb, options))
-            .selectFrom([
-            'table_list as tl',
-            sql `pragma_table_info(tl.name)`.as('p'),
-        ])
-            .select([
-            'tl.name as table',
-            'p.cid',
-            'p.name',
-            'p.type',
-            'p.notnull',
-            'p.dflt_value',
-            'p.pk',
-        ])
-            .orderBy('tl.name')
-            .orderBy('p.cid')
-            .execute();
+        // Get column metadata for each table separately since PRAGMA doesn't work in joins
         const columnsByTable = {};
-        for (const row of tableMetadata) {
-            columnsByTable[row.table] ??= [];
-            columnsByTable[row.table].push(row);
+        for (const table of tablesResult) {
+            try {
+                const columns = await sql `PRAGMA table_info(${sql.lit(table.name)})`.execute(this.#db);
+                columnsByTable[table.name] = columns.rows;
+            }
+            catch (error) {
+                console.warn(`Failed to get columns for table ${table.name}:`, error);
+                columnsByTable[table.name] = [];
+            }
         }
         return tablesResult.map(({ name, sql, type }) => {
             // Enhanced auto-increment detection
@@ -180,7 +169,7 @@ export class SqliteIntrospector extends DatabaseIntrospector {
     }
     async getColumns(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_table_info
+            // SQLite - use raw SQL for PRAGMA table_info
             const result = await sql `PRAGMA table_info(${sql.lit(tableName)})`.execute(this.#db);
             const sqliteColumns = result.rows;
             return sqliteColumns.map((col) => ({
@@ -199,7 +188,7 @@ export class SqliteIntrospector extends DatabaseIntrospector {
     }
     async getIndexes(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_index_list
+            // SQLite - use raw SQL for PRAGMA index_list
             const result = await sql `PRAGMA index_list(${sql.lit(tableName)})`.execute(this.#db);
             const sqliteIndexes = result.rows;
             return sqliteIndexes.map((idx) => ({
@@ -215,7 +204,7 @@ export class SqliteIntrospector extends DatabaseIntrospector {
     }
     async getForeignKeys(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_foreign_key_list
+            // SQLite - use raw SQL for PRAGMA foreign_key_list
             const result = await sql `PRAGMA foreign_key_list(${sql.lit(tableName)})`.execute(this.#db);
             const sqliteFks = result.rows;
             return sqliteFks.map((fk) => ({

package/dist/esm/dynamic/dynamic.d.ts

@@ -17,6 +17,10 @@ export declare class DynamicModule<DB> {
      * create an SQL injection vulnerability. Always __always__ validate the user
      * input before passing it to this method.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious column references. However, you should still validate that
+     * the column reference is from a trusted source or whitelist of allowed columns.
+     *
      * There are couple of examples below for some use cases, but you can pass
      * `ref` to other methods as well. If the types allow you to pass a `ref`
      * value to some place, it should work.
@@ -29,6 +33,12 @@ export declare class DynamicModule<DB> {
      * async function someQuery(filterColumn: string, filterValue: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate input against a whitelist of allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'email']
+     *   if (!allowedColumns.includes(filterColumn)) {
+     *     throw new Error('Invalid column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .selectAll()
@@ -46,6 +56,12 @@ export declare class DynamicModule<DB> {
      * async function someQuery(orderBy: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate against allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'created_at']
+     *   if (!allowedColumns.includes(orderBy)) {
+     *     throw new Error('Invalid order column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .select('person.first_name as fn')
@@ -92,6 +108,10 @@ export declare class DynamicModule<DB> {
      *
      * The type `T` is allowed to be a union of multiple tables.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious table references. However, you should still validate that
+     * the table reference is from a trusted source or whitelist of allowed tables.
+     *
      * <!-- siteExample("select", "Generic find query", 130) -->
      *
      * A generic type-safe helper function for finding a row by a column value:

package/dist/esm/dynamic/dynamic.js

@@ -1,6 +1,7 @@
 /// <reference types="./dynamic.d.ts" />
 import { DynamicReferenceBuilder } from './dynamic-reference-builder.js';
 import { DynamicTableBuilder } from './dynamic-table-builder.js';
+import { validateColumnReference, validateTableReference } from '../util/security-validator.js';
 export class DynamicModule {
     /**
      * Creates a dynamic reference to a column that is not know at compile time.
@@ -18,6 +19,10 @@ export class DynamicModule {
      * create an SQL injection vulnerability. Always __always__ validate the user
      * input before passing it to this method.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious column references. However, you should still validate that
+     * the column reference is from a trusted source or whitelist of allowed columns.
+     *
      * There are couple of examples below for some use cases, but you can pass
      * `ref` to other methods as well. If the types allow you to pass a `ref`
      * value to some place, it should work.
@@ -30,6 +35,12 @@ export class DynamicModule {
      * async function someQuery(filterColumn: string, filterValue: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate input against a whitelist of allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'email']
+     *   if (!allowedColumns.includes(filterColumn)) {
+     *     throw new Error('Invalid column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .selectAll()
@@ -47,6 +58,12 @@ export class DynamicModule {
      * async function someQuery(orderBy: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate against allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'created_at']
+     *   if (!allowedColumns.includes(orderBy)) {
+     *     throw new Error('Invalid order column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .select('person.first_name as fn')
@@ -88,6 +105,8 @@ export class DynamicModule {
      * ```
      */
     ref(reference) {
+        // Security validation to prevent SQL injection
+        validateColumnReference(reference);
         return new DynamicReferenceBuilder(reference);
     }
     /**
@@ -95,6 +114,10 @@ export class DynamicModule {
      *
      * The type `T` is allowed to be a union of multiple tables.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious table references. However, you should still validate that
+     * the table reference is from a trusted source or whitelist of allowed tables.
+     *
      * <!-- siteExample("select", "Generic find query", 130) -->
      *
      * A generic type-safe helper function for finding a row by a column value:
@@ -124,6 +147,8 @@ export class DynamicModule {
      * ```
      */
     table(table) {
+        // Security validation to prevent SQL injection
+        validateTableReference(table);
         return new DynamicTableBuilder(table);
     }
 }