noormme 1.0.0 → 1.0.2

package/dist/cjs/cli/commands/analyze.js

@@ -1,7 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyze = analyze;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
 async function analyze(options) {
     console.log(chalk_1.default.blue.bold('\n🔍 NOORMME Query Analysis - Intelligent Performance Insights\n'));

package/dist/cjs/cli/commands/generate.js

@@ -1,15 +1,53 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generate = generate;
 const fs_1 = require("fs");
-const path = require("path");
-const chalk_1 = require("chalk");
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
+const security_validator_js_1 = require("../../util/security-validator.js");
 async function generate(options = {}) {
     console.log(chalk_1.default.blue.bold('\n🔧 NOORMME Code Generation - Automating TypeScript & Repositories\n'));
     try {
-        // Initialize NOORMME with database path
-        const databasePath = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        const databasePath = (0, security_validator_js_1.sanitizeDatabasePath)(databasePathInput);
         const db = new noormme_js_1.NOORMME({
             dialect: 'sqlite',
             connection: {
@@ -22,7 +60,9 @@ async function generate(options = {}) {
         });
         await db.initialize();
         const schemaInfo = await db.getSchemaInfo();
+        // SECURITY: Validate output directory to prevent path traversal attacks
         const outputDir = options.output || './generated';
+        (0, security_validator_js_1.validateOutputDirectory)(outputDir);
         const format = options.format || 'dts';
         console.log(chalk_1.default.gray(`📁 Output directory: ${outputDir}`));
         console.log(chalk_1.default.gray(`📊 Discovered ${schemaInfo.tables.length} tables\n`));
@@ -186,11 +226,11 @@ function mapColumnToTsType(column) {
     }
     // JSON types
     if (type.includes('json')) {
-        return 'Record<string, any>';
+        return 'Record<string, unknown>';
     }
     // Array types
     if (type.includes('array') || type.includes('[]')) {
-        return 'any[]';
+        return 'unknown[]';
     }
     // UUID types
     if (type.includes('uuid')) {
@@ -201,11 +241,11 @@ function mapColumnToTsType(column) {
 }
 function getPrimaryKeyType(table) {
     if (!table.primaryKey || table.primaryKey.length === 0) {
-        return 'any';
+        return 'unknown';
     }
     if (table.primaryKey.length === 1) {
         const pkColumn = table.columns.find(col => col.name === table.primaryKey[0]);
-        return pkColumn ? mapColumnToTsType(pkColumn) : 'any';
+        return pkColumn ? mapColumnToTsType(pkColumn) : 'unknown';
     }
     // Composite primary key
     const types = table.primaryKey.map(pkCol => {

package/dist/cjs/cli/commands/init.js

@@ -1,16 +1,57 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.init = init;
-const inquirer_1 = require("inquirer");
+const inquirer_1 = __importDefault(require("inquirer"));
 const fs_1 = require("fs");
-const path = require("path");
-const chalk_1 = require("chalk");
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const security_validator_js_1 = require("../../util/security-validator.js");
 async function init(options) {
     console.log(chalk_1.default.blue.bold('\n🎯 NOORMME Zero-Configuration Setup\n'));
     console.log(chalk_1.default.gray('Setting up NOORMME with complete SQLite automation...\n'));
     try {
-        // Get database path
-        const databasePath = options.database || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || './database.sqlite';
+        const databasePath = (0, security_validator_js_1.sanitizeDatabasePath)(databasePathInput);
+        // SECURITY: Validate output directory to prevent path traversal attacks
+        const outputDir = options.output || 'lib';
+        (0, security_validator_js_1.validateOutputDirectory)(outputDir);
         console.log(chalk_1.default.blue('🔍 Detecting existing SQLite database...'));
         // Check if database exists
         const dbExists = await checkDatabaseExists(databasePath);
@@ -57,7 +98,6 @@ async function init(options) {
             return;
         }
         // Generate files with automation focus
-        const outputDir = options.output || 'lib';
         await generateDbFile(databasePath, outputDir, options.force, autoOptimize, autoIndex);
         await generateEnvExample(databasePath);
         await generateAutomationConfig(databasePath, autoOptimize, autoIndex);
@@ -122,7 +162,7 @@ async function generateDbFile(databasePath, outputDir, force, autoOptimize, auto
 
 // NOORMME with complete SQLite automation
 // Automatically discovers schema, generates types, and optimizes performance
-export const db = new NOORMME({
+const database = new NOORMME({
   dialect: 'sqlite',
   connection: { database: '${databasePath}' },
   
@@ -156,7 +196,7 @@ export const db = new NOORMME({
 
 // Initialize with complete automation
 export async function initializeDatabase() {
-  await db.initialize()
+  await database.initialize()
   console.log('🎉 NOORMME initialized with complete SQLite automation!')
   console.log('✅ Schema discovered automatically')
   console.log('✅ Types generated automatically')
@@ -165,32 +205,32 @@ export async function initializeDatabase() {
 
 // Get a repository for any table (auto-generated)
 export function getRepository<T>(tableName: string) {
-  return db.getRepository<T>(tableName)
+  return database.getRepository<T>(tableName)
 }
 
 // Get Kysely instance for complex queries
 export function getKysely() {
-  return db.getKysely()
+  return database.getKysely()
 }
 
 // Performance monitoring
 export async function getPerformanceMetrics() {
-  return await db.getSQLitePerformanceMetrics()
+  return await database.getSQLitePerformanceMetrics()
 }
 
 // Get optimization recommendations
 export async function getOptimizationRecommendations() {
-  return await db.getSQLiteIndexRecommendations()
+  return await database.getSQLiteIndexRecommendations()
 }
 
 // Apply optimizations
 export async function applyOptimizations() {
-  return await db.applySQLiteOptimizations()
+  return await database.applySQLiteOptimizations()
 }
 
 // Close database connections
 export async function closeDatabase() {
-  await db.close()
+  await database.close()
 }
 `;
     // Ensure directory exists

package/dist/cjs/cli/commands/inspect.js

@@ -1,13 +1,18 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspect = inspect;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
+const security_validator_js_1 = require("../../util/security-validator.js");
 async function inspect(tableName, options = {}) {
     console.log(chalk_1.default.blue.bold('\n🔍 NOORMME Schema Inspection - Intelligent Database Discovery\n'));
     try {
-        // Initialize NOORMME with database path
-        const databasePath = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        // SECURITY: Validate and sanitize database path to prevent path traversal attacks
+        const databasePathInput = options.database || process.env.DATABASE_PATH || './database.sqlite';
+        const databasePath = (0, security_validator_js_1.sanitizeDatabasePath)(databasePathInput);
         const db = new noormme_js_1.NOORMME({
             dialect: 'sqlite',
             connection: {
@@ -22,6 +27,8 @@ async function inspect(tableName, options = {}) {
         console.log(chalk_1.default.gray(`📁 Database: ${databasePath}\n`));
         const schemaInfo = await db.getSchemaInfo();
         if (tableName) {
+            // SECURITY: Validate table name to prevent SQL injection
+            (0, security_validator_js_1.validateIdentifier)(tableName, 'table name');
             // Show specific table with automation insights
             const table = schemaInfo.tables.find(t => t.name === tableName);
             if (!table) {

package/dist/cjs/cli/commands/migrate.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.migrate = migrate;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
 const fs_1 = require("fs");
-const path = require("path");
+const path = __importStar(require("path"));
 async function migrate(options) {
     console.log(chalk_1.default.blue.bold('\n🔄 NOORMME Migration Management - Automated Schema Evolution\n'));
     try {

package/dist/cjs/cli/commands/optimize.js

@@ -1,7 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.optimize = optimize;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
 async function optimize(options) {
     console.log(chalk_1.default.blue.bold('\n⚡ NOORMME SQLite Optimization - Automating Performance\n'));

package/dist/cjs/cli/commands/status.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.status = status;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
 const fs_1 = require("fs");
-const path = require("path");
+const path = __importStar(require("path"));
 async function status(options) {
     console.log(chalk_1.default.blue.bold('\n📊 NOORMME Status - Automation Dashboard\n'));
     try {
@@ -212,10 +248,10 @@ async function getAutomationStatus(db) {
     try {
         const config = db.config;
         return {
-            autoOptimization: config.performance?.enableAutoOptimization ?? true,
+            autoOptimization: config.automation?.enableAutoOptimization ?? true,
             queryAnalysis: config.performance?.enableQueryOptimization ?? true,
-            autoIndexing: config.performance?.enableAutoIndexing ?? true,
-            schemaMonitoring: config.watch?.enabled ?? false
+            autoIndexing: config.automation?.enableIndexRecommendations ?? true,
+            schemaMonitoring: config.automation?.enableSchemaWatcher ?? false
         };
     }
     catch {

package/dist/cjs/cli/commands/watch.js

@@ -1,7 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.watch = watch;
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const noormme_js_1 = require("../../noormme.js");
 async function watch(options) {
     console.log(chalk_1.default.blue.bold('\n👁️ NOORMME Schema Watcher - Continuous Automation\n'));

package/dist/cjs/cli/index.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
-const chalk_1 = require("chalk");
+const chalk_1 = __importDefault(require("chalk"));
 const init_js_1 = require("./commands/init.js");
 const inspect_js_1 = require("./commands/inspect.js");
 const generate_js_1 = require("./commands/generate.js");

package/dist/cjs/dialect/database-introspector.js

@@ -14,30 +14,24 @@ class DatabaseIntrospector {
      * Get all tables in the database
      */
     async getTables() {
-        try {
-            // SQLite
-            const sqliteTables = await this.db
-                .selectFrom('sqlite_master')
-                .select('name')
-                .where('type', '=', 'table')
-                .where('name', 'not like', 'sqlite_%')
-                .execute();
-            return sqliteTables.map(t => ({
-                name: t.name
-            }));
-        }
-        catch (error) {
-            console.warn('SQLite table discovery failed:', error);
-            throw new Error('Unable to introspect database tables. SQLite database required.');
-        }
+        // SQLite
+        const sqliteTables = await this.db
+            .selectFrom('sqlite_master')
+            .select('name')
+            .where('type', '=', 'table')
+            .where('name', 'not like', 'sqlite_%')
+            .execute();
+        return sqliteTables.map(t => ({
+            name: t.name
+        }));
     }
     /**
      * Get columns for a specific table
      */
     async getColumns(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_table_info
-            const result = await (0, sql_js_1.sql) `pragma_table_info(${sql_js_1.sql.lit(tableName)})`.execute(this.db);
+            // SQLite - use raw SQL for PRAGMA table_info
+            const result = await (0, sql_js_1.sql) `PRAGMA table_info(${sql_js_1.sql.lit(tableName)})`.execute(this.db);
             const sqliteColumns = result.rows;
             return sqliteColumns.map((col) => ({
                 name: col.name,
@@ -50,7 +44,8 @@ class DatabaseIntrospector {
         }
         catch (error) {
             console.warn('SQLite column discovery failed:', error);
-            throw new Error(`Unable to introspect columns for table '${tableName}'. SQLite database required.`);
+            // Return empty array instead of throwing for non-existent tables
+            return [];
         }
     }
     /**
@@ -65,8 +60,8 @@ class DatabaseIntrospector {
      */
     async getForeignKeys(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_foreign_key_list
-            const result = await (0, sql_js_1.sql) `pragma_foreign_key_list(${sql_js_1.sql.lit(tableName)})`.execute(this.db);
+            // SQLite - use raw SQL for PRAGMA foreign_key_list
+            const result = await (0, sql_js_1.sql) `PRAGMA foreign_key_list(${sql_js_1.sql.lit(tableName)})`.execute(this.db);
             const sqliteFks = result.rows;
             return sqliteFks.map((fk) => ({
                 name: `fk_${tableName}_${fk.from}`,

package/dist/cjs/dialect/sqlite/sqlite-introspector.js

@@ -40,28 +40,17 @@ class SqliteIntrospector extends database_introspector_js_1.DatabaseIntrospector
     }
     async #getTableMetadata(options) {
         const tablesResult = await this.#tablesQuery(this.#db, options).execute();
-        const tableMetadata = await this.#db
-            .with('table_list', (qb) => this.#tablesQuery(qb, options))
-            .selectFrom([
-            'table_list as tl',
-            (0, sql_js_1.sql) `pragma_table_info(tl.name)`.as('p'),
-        ])
-            .select([
-            'tl.name as table',
-            'p.cid',
-            'p.name',
-            'p.type',
-            'p.notnull',
-            'p.dflt_value',
-            'p.pk',
-        ])
-            .orderBy('tl.name')
-            .orderBy('p.cid')
-            .execute();
+        // Get column metadata for each table separately since PRAGMA doesn't work in joins
         const columnsByTable = {};
-        for (const row of tableMetadata) {
-            columnsByTable[row.table] ??= [];
-            columnsByTable[row.table].push(row);
+        for (const table of tablesResult) {
+            try {
+                const columns = await (0, sql_js_1.sql) `PRAGMA table_info(${sql_js_1.sql.lit(table.name)})`.execute(this.#db);
+                columnsByTable[table.name] = columns.rows;
+            }
+            catch (error) {
+                console.warn(`Failed to get columns for table ${table.name}:`, error);
+                columnsByTable[table.name] = [];
+            }
         }
         return tablesResult.map(({ name, sql, type }) => {
             // Enhanced auto-increment detection
@@ -182,7 +171,7 @@ class SqliteIntrospector extends database_introspector_js_1.DatabaseIntrospector
     }
     async getColumns(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_table_info
+            // SQLite - use raw SQL for PRAGMA table_info
             const result = await (0, sql_js_1.sql) `PRAGMA table_info(${sql_js_1.sql.lit(tableName)})`.execute(this.#db);
             const sqliteColumns = result.rows;
             return sqliteColumns.map((col) => ({
@@ -201,7 +190,7 @@ class SqliteIntrospector extends database_introspector_js_1.DatabaseIntrospector
     }
     async getIndexes(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_index_list
+            // SQLite - use raw SQL for PRAGMA index_list
             const result = await (0, sql_js_1.sql) `PRAGMA index_list(${sql_js_1.sql.lit(tableName)})`.execute(this.#db);
             const sqliteIndexes = result.rows;
             return sqliteIndexes.map((idx) => ({
@@ -217,7 +206,7 @@ class SqliteIntrospector extends database_introspector_js_1.DatabaseIntrospector
     }
     async getForeignKeys(tableName) {
         try {
-            // SQLite - use raw SQL for pragma_foreign_key_list
+            // SQLite - use raw SQL for PRAGMA foreign_key_list
             const result = await (0, sql_js_1.sql) `PRAGMA foreign_key_list(${sql_js_1.sql.lit(tableName)})`.execute(this.#db);
             const sqliteFks = result.rows;
             return sqliteFks.map((fk) => ({

package/dist/cjs/dynamic/dynamic.d.ts

@@ -17,6 +17,10 @@ export declare class DynamicModule<DB> {
      * create an SQL injection vulnerability. Always __always__ validate the user
      * input before passing it to this method.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious column references. However, you should still validate that
+     * the column reference is from a trusted source or whitelist of allowed columns.
+     *
      * There are couple of examples below for some use cases, but you can pass
      * `ref` to other methods as well. If the types allow you to pass a `ref`
      * value to some place, it should work.
@@ -29,6 +33,12 @@ export declare class DynamicModule<DB> {
      * async function someQuery(filterColumn: string, filterValue: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate input against a whitelist of allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'email']
+     *   if (!allowedColumns.includes(filterColumn)) {
+     *     throw new Error('Invalid column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .selectAll()
@@ -46,6 +56,12 @@ export declare class DynamicModule<DB> {
      * async function someQuery(orderBy: string) {
      *   const { ref } = db.dynamic
      *
+     *   // Validate against allowed columns
+     *   const allowedColumns = ['first_name', 'last_name', 'created_at']
+     *   if (!allowedColumns.includes(orderBy)) {
+     *     throw new Error('Invalid order column')
+     *   }
+     *
      *   return await db
      *     .selectFrom('person')
      *     .select('person.first_name as fn')
@@ -92,6 +108,10 @@ export declare class DynamicModule<DB> {
      *
      * The type `T` is allowed to be a union of multiple tables.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection
+     * through malicious table references. However, you should still validate that
+     * the table reference is from a trusted source or whitelist of allowed tables.
+     *
      * <!-- siteExample("select", "Generic find query", 130) -->
      *
      * A generic type-safe helper function for finding a row by a column value: